General

  • Target

    Astra Image Logger.exe

  • Size

    275KB

  • Sample

    250219-xqbvdaxkak

  • MD5

    a3696dd072443ecb27c0c7f12a14b61f

  • SHA1

    7525f55b0015b8ae66452c3ef143c18325ff9bd0

  • SHA256

    8807b5909f1b81254dfd6d62a3c4d590d1330085eaf786f6ff995617f8c5e562

  • SHA512

    aaba4ed34e31592ecf3f6c408a89aff88891d6ca9dcd3b8073f84ac6371ef7626e0d6783cf23fcfd7b055944c1a739cc64543986bc4cb4a95ba96def5af8a6ed

  • SSDEEP

    6144:zf+BLtABPDwnBoKVjuGHm0uu4zblYeJ7lA1D03v9:AnXjm0uu4/lYeM1De9

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1067305012188958802/Toi3qZ0OM4SmK4Z6bWOUhNfyduj98KvQjF8a_1cAjycHP2nSnt94ILWCXAZ6BeViBqUy

Targets

    • Target

      Astra Image Logger.exe

    • Size

      275KB

    • MD5

      a3696dd072443ecb27c0c7f12a14b61f

    • SHA1

      7525f55b0015b8ae66452c3ef143c18325ff9bd0

    • SHA256

      8807b5909f1b81254dfd6d62a3c4d590d1330085eaf786f6ff995617f8c5e562

    • SHA512

      aaba4ed34e31592ecf3f6c408a89aff88891d6ca9dcd3b8073f84ac6371ef7626e0d6783cf23fcfd7b055944c1a739cc64543986bc4cb4a95ba96def5af8a6ed

    • SSDEEP

      6144:zf+BLtABPDwnBoKVjuGHm0uu4zblYeJ7lA1D03v9:AnXjm0uu4/lYeM1De9

    • 44Caliber

      An open source infostealer written in C#.

    • 44Caliber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks