General

  • Target

    Cheat (infected).zip

  • Size

    118KB

  • Sample

    241006-er7z4awgmh

  • MD5

    15f46c82a77c063fafd0680607445a08

  • SHA1

    21d3cdc457ad15c9d8b04f94b51219f0c6fb18f2

  • SHA256

    1e7693ae47f44094b0304e65a2e9ac992e09d1c9fbe3087fa45c359b6db2a0e7

  • SHA512

    fb3ae7bd1c68f872048ea041c19a43e2fa44f0fd2fc4b9f74f65f6a03ef98d04c14e49f4fb4ec8d00b0c8f071df4726fd7042e0176c2311728977195c8a9e0f6

  • SSDEEP

    3072:YsoGBxqrKsTCLNLX1lTAtEsBR5mNc6hJW/Slwiqx:yGBxq2mG1lTmca6bUSPQ

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/897533314720759858/2IthAY1F50e0tIWa51HPNxK5_vNppGvmSOFSU_Yq3riGW0BMzST3MUD9P7wE1B_qSnT5

Targets

    • Target

      Cheat.exe

    • Size

      303KB

    • MD5

      02d6afbd57a884836f0c845f9870af7f

    • SHA1

      3543d551d9369672ad781781efcd450b0bea2bdb

    • SHA256

      359c20f4dd6423e91635c3d6cc365959e438dc12aeb3353c17e3b1641efc4835

    • SHA512

      110c8d9ba3fa21d9a10ceac293b447dab45e1438fc4cb509598228fc0aa7c5b8d35ea4dc55bba3afffd60e2679a60694e856efee351a152651e6d3c7d263546a

    • SSDEEP

      6144:B5hxT6MDdbICydeBvQ26i2dVTZy6jmA1D06k5:B5dY26i2vT4Y1DW5

    • 44Caliber

      An open source infostealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks