44caliber | LOLO[.]exe | Triage

Sharing

General

Target

LOLO.exe
Size

303KB
MD5

087e4fc1f01e0f295ac3873ad541bf56
SHA1

17024ebb6f8135439a491618748ea2bf482d4b9c
SHA256

2c36cc0292ba8775d195d6dc9df68f45e97ba9bc2f4a35a600edb6072a46e010
SHA512

04d6605dd89fef1f715454610443a4212b6ea2d8ebad9041fcdad151a7f73277758573827072eccbf34470c8528c57c359593df98d161c498e7807e2938b080e
SSDEEP

6144:/Xt3T6MDdbICydeBimcmXKhJUPw6kmA1D0Dxp:/XttpcmXKnUo31D+p

Score

10^/10

44caliber

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1296484026433146951/82aR0Nt59Eb92ax2wMZUmGit_E6YL5mUsg5RulT8ws8SXcVkvKauDGcyXREEovQ9v_F5

Signatures

44caliber family
44caliber

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
LOLO.exe

Files

LOLO.exe
.exe windows:4 windows x86 arch:x86

Password: 111

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\атем\Desktop\44CALIBER-main\44CALIBER-main\44CALIBER\obj\Debug\Insidious.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 301KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ