General

  • Target

    Insidious.exe

  • Size

    302KB

  • Sample

    241130-x1na6aslcy

  • MD5

    777e0fd76dce46c05e55564d8465632f

  • SHA1

    05ca2a12ca319d20d8dfd64d46a88f88ec2a9a97

  • SHA256

    eff592526e32ba395227cc4521588f2a3858583d66e652af84b4a5346b8104c2

  • SHA512

    179365a7766653bd3de2f06304fbc25cb4dcac31edde723735cecd1a2f531b4692c4b9430a1f68832192f12494c6199a3e3fa6531cd09b67ff981d38cd8d7f90

  • SSDEEP

    6144:ARlT6MDdbICydeBV9suqPmlF62Yr8RmA1D0+Tf:ART4uqPmH68b1DBf

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1262786010446696519/TF6h3fODHclXs66DoTWXW06HBQRMNnQ8AtN7KAb1UQJyUlcMqh_TPBHkwcOcPFBUoC1q

Targets

    • Target

      Insidious.exe

    • Size

      302KB

    • MD5

      777e0fd76dce46c05e55564d8465632f

    • SHA1

      05ca2a12ca319d20d8dfd64d46a88f88ec2a9a97

    • SHA256

      eff592526e32ba395227cc4521588f2a3858583d66e652af84b4a5346b8104c2

    • SHA512

      179365a7766653bd3de2f06304fbc25cb4dcac31edde723735cecd1a2f531b4692c4b9430a1f68832192f12494c6199a3e3fa6531cd09b67ff981d38cd8d7f90

    • SSDEEP

      6144:ARlT6MDdbICydeBV9suqPmlF62Yr8RmA1D0+Tf:ART4uqPmH68b1DBf

    • 44Caliber

      An open source infostealer written in C#.

    • 44Caliber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks