General

  • Target

    b9f641e833bf3605544cbdad55ac15485307a4a50ded37142fc4ea5f668cb453N

  • Size

    303KB

  • Sample

    241010-d96pbawhrc

  • MD5

    ef510464a3d8928dbccdab5cbe2249c0

  • SHA1

    a20c03443a8279717430b86cdbc38fe6ada088eb

  • SHA256

    b9f641e833bf3605544cbdad55ac15485307a4a50ded37142fc4ea5f668cb453

  • SHA512

    97a6ab7759834b4bb2db5a8ebadc3c549bc5383edb2358cbb69a19c1e1de9529fc083f4d4e6cc87bf4be421766036a04c2bab482436234046731424167153d31

  • SSDEEP

    6144:8Xt3T6MDdbICydeBimcmXKhJUPw6jmA1D0bVs:8XttpcmXKnUoY1Dms

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1292528994620538911/b4Kbyxg1xDjUFAcWJSUfjn2DKcY8pdGE4lxFXa8owajjCsbtPiwbxPBB9k29Y86QwgML

Targets

    • Target

      b9f641e833bf3605544cbdad55ac15485307a4a50ded37142fc4ea5f668cb453N

    • Size

      303KB

    • MD5

      ef510464a3d8928dbccdab5cbe2249c0

    • SHA1

      a20c03443a8279717430b86cdbc38fe6ada088eb

    • SHA256

      b9f641e833bf3605544cbdad55ac15485307a4a50ded37142fc4ea5f668cb453

    • SHA512

      97a6ab7759834b4bb2db5a8ebadc3c549bc5383edb2358cbb69a19c1e1de9529fc083f4d4e6cc87bf4be421766036a04c2bab482436234046731424167153d31

    • SSDEEP

      6144:8Xt3T6MDdbICydeBimcmXKhJUPw6jmA1D0bVs:8XttpcmXKnUoY1Dms

    • 44Caliber

      An open source infostealer written in C#.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks