Overview

overview

10

Static

static

10

66c68a3d95...b9.exe

windows7-x64

10

66c68a3d95...b9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    66c68a3d95d231010e91deed9676b68a529955d8cd44e41fd6dc55a19143acb9

  • Size

    303KB

  • Sample

    240818-nnxjmasajc

  • MD5

    f5a2f1da8fcc5e51cc8eec426fa3e545

  • SHA1

    da3c79d8d5e6584d3adbd71912291d18681ee109

  • SHA256

    66c68a3d95d231010e91deed9676b68a529955d8cd44e41fd6dc55a19143acb9

  • SHA512

    ea3f4b03b149f97e500679d0667b5c1c7b66db242ef27c8520f4b86a5e706ca8424d49ec154cebe90ec1643bbe1a4c5f5e82261ec5f77137e408e8428bc13ec9

  • SSDEEP

    6144:HtBuT6MDdbICydeBPKqCBu19FsN6LmA1D0CKU:HtaSqCBu/Few1DUU

Score
10/10
44calibercredential_accessspywarestealer

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1259819169050923028/FgFc46vkD5YoeeRf3p_mErGG96JCipzz-kU6-Gb301GlKvAaNpgaDswVn7i9JLTzy5-c

Targets

    • Target

      66c68a3d95d231010e91deed9676b68a529955d8cd44e41fd6dc55a19143acb9

    • Size

      303KB

    • MD5

      f5a2f1da8fcc5e51cc8eec426fa3e545

    • SHA1

      da3c79d8d5e6584d3adbd71912291d18681ee109

    • SHA256

      66c68a3d95d231010e91deed9676b68a529955d8cd44e41fd6dc55a19143acb9

    • SHA512

      ea3f4b03b149f97e500679d0667b5c1c7b66db242ef27c8520f4b86a5e706ca8424d49ec154cebe90ec1643bbe1a4c5f5e82261ec5f77137e408e8428bc13ec9

    • SSDEEP

      6144:HtBuT6MDdbICydeBPKqCBu19FsN6LmA1D0CKU:HtaSqCBu/Few1DUU

    Score
    10/10
    44calibercredential_accessspywarestealer

    • 44Caliber

      An open source infostealer written in C#.

      stealer44caliber

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks