Analysis
-
max time kernel
429s -
max time network
430s -
platform
windows11-21h2_x64 -
resource
win11-20250210-en -
resource tags
-
submitted
10/02/2025, 14:03
General
-
Target
Loader.exe
-
Size
303KB
-
MD5
06cefa8ca9d8b957ff7862c2bc095532
-
SHA1
00ddd5275d33b114891e8a1304f022cf31a3badc
-
SHA256
d6ff445d907d3cf0ca59cc2fa738de8b83f03c8bcb1420f425adf5b113fbdf38
-
SHA512
5e53b85ac8694cdcfab457a872811a5e42da18ab41de32b12d2ed28c32b9e4090c069833caf6fc9b02f9717314f5647027f85b506bea6ecf6f639d64c8d4aa90
-
SSDEEP
6144:uNFT6MDdbICydeBpxUKCa269TwHfw6fmA1D0H/s:uNzIKCa2yT301DUs
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/1338494455816130602/RfPMucy7qNgnF1KO1MI5iOATLOqPdaYE1pn3HhuPCtXjqRXs3t1NFhCJsYBUYOc2mSD5
Signatures
-
44Caliber
An open source infostealer written in C#.
-
44Caliber family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
291KB
MD5946018322026b4d812f84dd3fa63db34
SHA159a5480316ffce371745e470718d0432119d013e
SHA2562b014112e22d4ade0ec65aa45c7684fdafa926938cf5397c8662508d7321719b
SHA5129eb5c18b0560dc006c5ded90c093912c1e735426bf51d3795deb5c9c36df7ad5590c9e8a8cb2c8001cfc4db2cb94bafe14c5c16c94cee7cb1fd8255f482adc6b
-
Filesize
8KB
-
Filesize
328KB
-
Filesize
10.8MB
-
Filesize
10.8MB