General

  • Target

    5fe7cb7b48bbc726f862382deb5d98620154749c4fae4e8068e5745a20b4456fN.exe

  • Size

    274KB

  • Sample

    250202-sz5rlaxpht

  • MD5

    2ab69a9c4d13e5a5dc02c630ab6a2a50

  • SHA1

    64ea40e8f976dc4ca3d9197b5617017a3d790640

  • SHA256

    5fe7cb7b48bbc726f862382deb5d98620154749c4fae4e8068e5745a20b4456f

  • SHA512

    604b5e88cc95423be2bff9471cd8c2fdcae7a57b66f672cb22d0b3d761b4993a821b23fe26c03d8c19565e66695646993f153a7c6fc340b15d80a4cd23b8ce7a

  • SSDEEP

    6144:Cf+BLtABPD345GxbeCpwaUsZ3FVafTrNlI1D0Z2c:y4sZKaUsZ3sg1Dfc

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1268575223754522654/p3kG7TYiNnRJt6AGaKl6yqWSNq4m8D-z5DmsFHvopaDzLbxf2LlN6fYTIX4FWMVt7UOg

Targets

    • Target

      5fe7cb7b48bbc726f862382deb5d98620154749c4fae4e8068e5745a20b4456fN.exe

    • Size

      274KB

    • MD5

      2ab69a9c4d13e5a5dc02c630ab6a2a50

    • SHA1

      64ea40e8f976dc4ca3d9197b5617017a3d790640

    • SHA256

      5fe7cb7b48bbc726f862382deb5d98620154749c4fae4e8068e5745a20b4456f

    • SHA512

      604b5e88cc95423be2bff9471cd8c2fdcae7a57b66f672cb22d0b3d761b4993a821b23fe26c03d8c19565e66695646993f153a7c6fc340b15d80a4cd23b8ce7a

    • SSDEEP

      6144:Cf+BLtABPD345GxbeCpwaUsZ3FVafTrNlI1D0Z2c:y4sZKaUsZ3sg1Dfc

    • 44Caliber

      An open source infostealer written in C#.

    • 44Caliber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks