General

  • Target

    4a04f95c61968a10bdd78cde0cbfb64961cfb8750daf55add7e90540fb1a5d36

  • Size

    274KB

  • Sample

    241209-sq6yaswrhm

  • MD5

    7e660d076ab21dccbd485801e651d6bf

  • SHA1

    b451313e8e78c4a1389dbc6b709377fd5082ef83

  • SHA256

    4a04f95c61968a10bdd78cde0cbfb64961cfb8750daf55add7e90540fb1a5d36

  • SHA512

    bd9a475ad92e82ae71bbbee088a9af454ecb7348b93b4632a812f6180e165412a10000caf71d2f5844dce84fdcf3f015be7437c21ca7cec04a57370c7f7f6440

  • SSDEEP

    6144:4f+BLtABPDsth6Ej/UZkI4TjkRy5BafTyUlI1D0KMB:LtK+I4TjkRypZ1DKB

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1146486791835230260/bE9QI2eAT_dyqn0dm7VljbMDjUklfKOXxq3ua0HOtKeG6TIgizThvorpCYQf2NEkabwH

Targets

    • Target

      4a04f95c61968a10bdd78cde0cbfb64961cfb8750daf55add7e90540fb1a5d36

    • Size

      274KB

    • MD5

      7e660d076ab21dccbd485801e651d6bf

    • SHA1

      b451313e8e78c4a1389dbc6b709377fd5082ef83

    • SHA256

      4a04f95c61968a10bdd78cde0cbfb64961cfb8750daf55add7e90540fb1a5d36

    • SHA512

      bd9a475ad92e82ae71bbbee088a9af454ecb7348b93b4632a812f6180e165412a10000caf71d2f5844dce84fdcf3f015be7437c21ca7cec04a57370c7f7f6440

    • SSDEEP

      6144:4f+BLtABPDsth6Ej/UZkI4TjkRy5BafTyUlI1D0KMB:LtK+I4TjkRypZ1DKB

    • 44Caliber

      An open source infostealer written in C#.

    • 44Caliber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks