General

  • Target

    3c2167a8185cbc012db49cbdf0edb9bf90e8ffe34453e3d4a42d6419f0d9564f.exe

  • Size

    274KB

  • Sample

    241127-rxd1esxley

  • MD5

    9b532ca59da4806a6ad268a6747ea550

  • SHA1

    dc29c06573a11d944e96a7376f5032d4d4e31fa6

  • SHA256

    3c2167a8185cbc012db49cbdf0edb9bf90e8ffe34453e3d4a42d6419f0d9564f

  • SHA512

    57ca728951d38a723bd6059df616304eff16a883c7ba6d8ac9153800ff26d9a3e7b786e3e734a700362a04721065d62b75aaf5f7c3d4379de6b6517e9e6c4cb7

  • SSDEEP

    6144:df+BLtABPDLgj1xw1eO5rbMMzhgUsYqTXGR1afTyclI1D02SIS:6161eO5rbHHsYqTXG9R1DUIS

Malware Config

Extracted

Family

44caliber

C2

https://discordapp.com/api/webhooks/1165023408308883527/fHcVLlt-XS3bpeW4Pr9RnfIG-6FlU5L4fEDsBCSSGSwNqbsOngyplRsyoD4tshYENWIO

Targets

    • Target

      3c2167a8185cbc012db49cbdf0edb9bf90e8ffe34453e3d4a42d6419f0d9564f.exe

    • Size

      274KB

    • MD5

      9b532ca59da4806a6ad268a6747ea550

    • SHA1

      dc29c06573a11d944e96a7376f5032d4d4e31fa6

    • SHA256

      3c2167a8185cbc012db49cbdf0edb9bf90e8ffe34453e3d4a42d6419f0d9564f

    • SHA512

      57ca728951d38a723bd6059df616304eff16a883c7ba6d8ac9153800ff26d9a3e7b786e3e734a700362a04721065d62b75aaf5f7c3d4379de6b6517e9e6c4cb7

    • SSDEEP

      6144:df+BLtABPDLgj1xw1eO5rbMMzhgUsYqTXGR1afTyclI1D02SIS:6161eO5rbHHsYqTXG9R1DUIS

    • 44Caliber

      An open source infostealer written in C#.

    • 44Caliber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks