General

  • Target

    3f25f1c33d0711c5cc773b0e7a6793d2ae57e3bf918b176e2fa1afad55a7337a

  • Size

    303KB

  • Sample

    241212-w6qg2avmam

  • MD5

    a9255b6f4acf2ed0be0f908265865276

  • SHA1

    526591216c42b2ba177fcb927feee22267a2235d

  • SHA256

    3f25f1c33d0711c5cc773b0e7a6793d2ae57e3bf918b176e2fa1afad55a7337a

  • SHA512

    86d6eaf7d07168c3898ef0516bbd60ef0a2f5be097a979deb37cea90c71daff92da311c138d717e4bb542de1dbd88ef1b6f745b9acbfb23456dd59119d556a50

  • SSDEEP

    6144:w/oT6MDdbICydeBrdEGHpcJWbg6hmA1D0yOc:w/WJEGHpQWEa1DQc

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1296494108667416678/ZASeLgYlw4OZSUv8h9jKQd4eY6ktpyF3T4vMXTNf0Ppbac5asKxIs_xZz8YEc__J4qsO

Targets

    • Target

      3f25f1c33d0711c5cc773b0e7a6793d2ae57e3bf918b176e2fa1afad55a7337a

    • Size

      303KB

    • MD5

      a9255b6f4acf2ed0be0f908265865276

    • SHA1

      526591216c42b2ba177fcb927feee22267a2235d

    • SHA256

      3f25f1c33d0711c5cc773b0e7a6793d2ae57e3bf918b176e2fa1afad55a7337a

    • SHA512

      86d6eaf7d07168c3898ef0516bbd60ef0a2f5be097a979deb37cea90c71daff92da311c138d717e4bb542de1dbd88ef1b6f745b9acbfb23456dd59119d556a50

    • SSDEEP

      6144:w/oT6MDdbICydeBrdEGHpcJWbg6hmA1D0yOc:w/WJEGHpQWEa1DQc

    • 44Caliber

      An open source infostealer written in C#.

    • 44Caliber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks