44caliber

General

Target

366f08500694a72d97a16affa8009f0ff88d859807a7d2cc9533aca6d7c4faf4.exe
Size

898KB
Sample

240907-bjxydaxdlh
MD5

ccfa4401df6dcaef4265f5edd06f3fde
SHA1

f96f403087bb1ad5483bc68a5a3db8a1ca833f4e
SHA256

366f08500694a72d97a16affa8009f0ff88d859807a7d2cc9533aca6d7c4faf4
SHA512

02d1efcaaf84cd39c585359edc613daac7d6006adcd714b027d2f9ac5fe8184cb5cc7bb61762cd766d4f409149635d422d8a4b318970c6666e7caf2c16d208ac
SSDEEP

24576:9tZhUkDINlUj3HMcggFUnCwCjsiD5udn3:9tZySIUj3HDgyUCrjsi

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

stage-von.gl.at.ply.gg:19496

Attributes

Install_directory
%AppData%
install_file
USB.exe

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1277266868607909908/QiJcGAwDqWNtmVvOEAXbQRof-6-EayQHWtIisK36ihRezCI8pq0CiZEozVxo5r80Fkm9

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1277266868607909908/QiJcGAwDqWNtmVvOEAXbQRof-6-EayQHWtIisK36ihRezCI8pq0CiZEozVxo5r80Fkm9

Targets

- Target
  
  366f08500694a72d97a16affa8009f0ff88d859807a7d2cc9533aca6d7c4faf4.exe
- Size
  
  898KB
- MD5
  
  ccfa4401df6dcaef4265f5edd06f3fde
- SHA1
  
  f96f403087bb1ad5483bc68a5a3db8a1ca833f4e
- SHA256
  
  366f08500694a72d97a16affa8009f0ff88d859807a7d2cc9533aca6d7c4faf4
- SHA512
  
  02d1efcaaf84cd39c585359edc613daac7d6006adcd714b027d2f9ac5fe8184cb5cc7bb61762cd766d4f409149635d422d8a4b318970c6666e7caf2c16d208ac
- SSDEEP
  
  24576:9tZhUkDINlUj3HMcggFUnCwCjsiD5udn3:9tZySIUj3HDgyUCrjsi
Score

10^/10

44caliber umbral xworm credential_access discovery execution persistence rat spyware stealer trojan
- 44Caliber
  An open source infostealer written in C#.
  stealer 44caliber
- Detect Umbral payload
- Detect Xworm Payload
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2