44caliber | Insidious[.]exe | Triage

Sharing

General

Target

Insidious.exe
Size

303KB
MD5

9aa717cec4e9f75aa00e786eae4a3d04
SHA1

ac99a075824a6b085745e302ff48abf368d31d27
SHA256

158ec994a6de6b0b7cffcf86c9474f91cacdb6b0ce0e7a070df250870cc0c044
SHA512

8d092206c0f3d11e2f5146bbc15488990c2952dbd843188aa91c745b5a513f9ea3d63ced78a113c17544d684031f123ec989034fafd1f70c9f355efc02fccde5
SSDEEP

6144:dRlT6MDdbICydeBV9suqPmlF62y6hmA1D0tUt:dRT4uqPmH6Da1D5t

Score

10^/10

44caliber

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1338833550199492618/rw2c6QUr58msenoKNKsg8ZLDsVFUzkO7iGhk2kE6ipUW1tOa4RuHOLFqDfRB05yiIfWD

Signatures

44caliber family
44caliber

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Insidious.exe

Files

Insidious.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\kobza\Desktop\Рабочий стол\рат\stealer\44CALIBER-main\44CALIBER\obj\Debug\Insidious.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 301KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ