General

  • Target

    d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82

  • Size

    303KB

  • Sample

    241113-dm7m4awbln

  • MD5

    5c6721a4445b1ad34affb5d66c987573

  • SHA1

    d2f20db4d9a3fd2e72a0545926b6fee1f3283d47

  • SHA256

    d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82

  • SHA512

    15c3d229c7ad3e2036405c68f7f59f03cf774348e89d7fdf04cf0c1220c34cd6029bb5b96a5084a056cb4aadab2474a915a0c0640015e5ccd30c472a68a2e085

  • SSDEEP

    6144:PjFT6MDdbICydeB0iG54G4S+ZoH86jmA1D0/Hx:PjzQ54G4SuocY1Dsx

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1303704145731260446/-6ntBnd7ROApHmCsRB7Lli7gKTsLyWRgcOJ-cJbRXh5PQKViLyldpkyDBWbuBRUun_nd

Targets

    • Target

      d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82

    • Size

      303KB

    • MD5

      5c6721a4445b1ad34affb5d66c987573

    • SHA1

      d2f20db4d9a3fd2e72a0545926b6fee1f3283d47

    • SHA256

      d5c99e1f25dbdbec5a2545a4cea9e948f7b7c8188cc966b8ac69f3b1b95cea82

    • SHA512

      15c3d229c7ad3e2036405c68f7f59f03cf774348e89d7fdf04cf0c1220c34cd6029bb5b96a5084a056cb4aadab2474a915a0c0640015e5ccd30c472a68a2e085

    • SSDEEP

      6144:PjFT6MDdbICydeB0iG54G4S+ZoH86jmA1D0/Hx:PjzQ54G4SuocY1Dsx

    • 44Caliber

      An open source infostealer written in C#.

    • 44Caliber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks