General

  • Target

    c8bc237c1c9a16a0b61fe14f020a4680_JaffaCakes118

  • Size

    252KB

  • Sample

    241205-v59nva1kcl

  • MD5

    c8bc237c1c9a16a0b61fe14f020a4680

  • SHA1

    180816de04c2dcc1bed74070afac06b740d91318

  • SHA256

    3c5606af64bc6d9e74aae62b177b9a0a5b16a86ff68f8b2925ad8971f9933038

  • SHA512

    0781b3ace5353840769085d1dd443323e37bd09d7f52db62cedfd102f424a6d7b4da7fac7e23b004a3bb8487e9a1a2c83ac4f3bf424273d47fe54710d04f98c9

  • SSDEEP

    3072:F07eU2iSjjuUPFLpsXMZgPBU13oNod6bcN9ToZ8E2PBfH4Ekz1eaMjAmectm13hv:SeUyjPjmPBUqN26bWW8EUJY1z1eRbp2

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/868196565515390987/7Jj72FAQ3nmAQ7X65Vp30BjA9kjuE3DDz3XgiNTRUNUr9fbEC6Rznra0GuxDjkoxkX4A

Targets

    • Target

      c8bc237c1c9a16a0b61fe14f020a4680_JaffaCakes118

    • Size

      252KB

    • MD5

      c8bc237c1c9a16a0b61fe14f020a4680

    • SHA1

      180816de04c2dcc1bed74070afac06b740d91318

    • SHA256

      3c5606af64bc6d9e74aae62b177b9a0a5b16a86ff68f8b2925ad8971f9933038

    • SHA512

      0781b3ace5353840769085d1dd443323e37bd09d7f52db62cedfd102f424a6d7b4da7fac7e23b004a3bb8487e9a1a2c83ac4f3bf424273d47fe54710d04f98c9

    • SSDEEP

      3072:F07eU2iSjjuUPFLpsXMZgPBU13oNod6bcN9ToZ8E2PBfH4Ekz1eaMjAmectm13hv:SeUyjPjmPBUqN26bWW8EUJY1z1eRbp2

    • 44Caliber

      An open source infostealer written in C#.

    • 44Caliber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks