Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
19-02-2025 10:33
General
-
Target
Задания и ответы ЕГЭ 2025.exe
-
Size
576KB
-
MD5
c8e53f9e2b3486e3402cff07b301ad57
-
SHA1
27bd6460f5eeb7286f54a6dec056b59c34155963
-
SHA256
80359c5b29862236c579ca430e87a005961cc043e1d331d7d6c0e28b0549f643
-
SHA512
eb385491d43e3c164fef312a30e304bb10b2073fad6cb60f0e6010464309b4f5850c84ad8a9cd32ce5a93398358ba64074294d6e62412f9ec26b62728c26fa69
-
SSDEEP
12288:1+OodNa0FcjlUIO/GxJc3RHa2aE+e6Q3fM5pydesxY1IOlT4zrC+WmjMA3w1Oogu:1EdNa
Malware Config
Extracted
44caliber
https://discordapp.com/api/webhooks/1338186901810839563/eKerOwDj2c9szzTdBYdfvxKykXdW4D18_ENzXnU3p0yI_WMl5K0D3Sm4qc4WEsKO8eKT
Signatures
-
44Caliber
An open source infostealer written in C#.
-
44Caliber family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Задания и ответы ЕГЭ 2025.exe"C:\Users\Admin\AppData\Local\Temp\Задания и ответы ЕГЭ 2025.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
600KB
-
Filesize
10.8MB
-
Filesize
10.8MB