44caliber | TOTAL[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
TOTAL.zip
Size 1.2MB
Sample240720-rhp45szerc
SHA256 1862de02fa8eff612a8d616c5d405bc5898c35fd3cfc74c6b8ceeda8b5bb8db3
MD5 5fd4329f29c730ff72f4055d799662b2
SHA1 090cd87c84bd78d6a9d36d5ae4c5bd7510b757ea
SHA512 9df46d763fbaa1594341d72fbd79d088f5f5658c5d428df07974190ce3b123476786bc78425739603e2f11aab8164e7492ec8b94554d7793526a224d730cbe16
SSDEEP 12288:7zi5IGv20sKM1DbOQ+OAsy7D9vLYGCK3L50o9vC0P:yl2gBQYznlLYS3PlX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

44caliber

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1259949517135151126/locx-MKcF15uY85qiDh_Kt5nRCte0luK62KFHfEH79iF3r9uRpGPhsG-g9YijITFCe5d

Signatures

44caliber family
44caliber

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CR9CK/CR9CK.exe

File Explorer

TOTAL.zip

.zip 1.2MB
CR9CK/CR9CK.exe

.exe 303KB
CR9CK/CR9CK.pdb

955KB
CR9CK/progress.exe.config

.xml 161B

TOTAL.zip

SHA256 1862de02fa8eff612a8d616c5d405bc5898c35fd3cfc74c6b8ceeda8b5bb8db3
MD5 5fd4329f29c730ff72f4055d799662b2
SHA1 090cd87c84bd78d6a9d36d5ae4c5bd7510b757ea
SHA512 9df46d763fbaa1594341d72fbd79d088f5f5658c5d428df07974190ce3b123476786bc78425739603e2f11aab8164e7492ec8b94554d7793526a224d730cbe16
SSDEEP 12288:7zi5IGv20sKM1DbOQ+OAsy7D9vLYGCK3L50o9vC0P:yl2gBQYznlLYS3PlX
MD5 SHA1 SHA512 SSDEEP

Password

xTkGgyLBDcQ_7vs3-2jbwA

CR9CK/CR9CK.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4164f7408da2a5a31318d8a6da3c17546f6782822a07e928c0824401cce69830
MD5 d58c2577966ca8563fd69729151f52ea
SHA1 efed2d279e6b2a23a46392731cc8d36411bcdcb3
SHA512 8502777f3ddca95dcda8f1962945f6285ee0fe2a2bf008d35066bf0b6eb97733822d7ade6c6b5134c64036d2a2d80802641529283cd30d757bc0b552a5fc9b1c
SSDEEP 6144:Uz2ZNT6MDdbICydeBblLIGv2A5siP6vmA1D0g/O:Uzi5IGv20sKM1DbO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

xTkGgyLBDcQ_7vs3-2jbwA

Minor OS version

Major OS version

Entry point

306638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\artem\Desktop\44CALIBER-main\44CALIBER\obj\Debug\Insidious.pdb

TOTAL.zip

CR9CK/CR9CK.exe

mscoree

dotnet

CR9CK/CR9CK.pdb

CR9CK/progress.exe.config