General

  • Target

    a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27N.exe

  • Size

    274KB

  • Sample

    241128-r26w1azrfw

  • MD5

    ec34999e9a72c881a1f8a2b62f2a2f40

  • SHA1

    e88e76616617e2d57d5a3b2d8767834ea5f503e4

  • SHA256

    a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27

  • SHA512

    f92a988c25415a72a55527b9ad4ccb095fef8592d4fb34ee14a243d1d0b4cc696e9867f62b25d5564c019c623444b5f277961830f78f3dc20f52a9fa28972e4f

  • SSDEEP

    6144:df+BLtABPDLgj1xw1eO5rbMMzhgUsYqTXGR1afTyclI1D02SI:6161eO5rbHHsYqTXG9R1DUI

Malware Config

Extracted

Family

44caliber

C2

https://discordapp.com/api/webhooks/1165023408308883527/fHcVLlt-XS3bpeW4Pr9RnfIG-6FlU5L4fEDsBCSSGSwNqbsOngyplRsyoD4tshYENWIO

Targets

    • Target

      a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27N.exe

    • Size

      274KB

    • MD5

      ec34999e9a72c881a1f8a2b62f2a2f40

    • SHA1

      e88e76616617e2d57d5a3b2d8767834ea5f503e4

    • SHA256

      a1b97d34a7c63f1c43599a9f241125e6690a2234459243eba67f998b599a2d27

    • SHA512

      f92a988c25415a72a55527b9ad4ccb095fef8592d4fb34ee14a243d1d0b4cc696e9867f62b25d5564c019c623444b5f277961830f78f3dc20f52a9fa28972e4f

    • SSDEEP

      6144:df+BLtABPDLgj1xw1eO5rbMMzhgUsYqTXGR1afTyclI1D02SI:6161eO5rbHHsYqTXG9R1DUI

    • 44Caliber

      An open source infostealer written in C#.

    • 44Caliber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks