General

  • Target

    Insidious.exe

  • Size

    303KB

  • Sample

    250411-pbrchsytfx

  • MD5

    8da327f6fdd14d482e3e4f1706c1ec07

  • SHA1

    32cad906c6707f1e2a3be3ef6c4ea1fc8828841f

  • SHA256

    241123897cdb67ffff90098d85012c28e7c0b31a14c6263398720f2bc7d21db3

  • SHA512

    ffa4776fb8638cbeb45099543305ceff769368e53c60e6de9ae3cb76078ba9fff13b8b3a7f655bcbd08af58f9a7e835e09c575966c9c15907bccd5b0f47ac3af

  • SSDEEP

    6144:plFT6MDdbICydeBjy5i25C9nb/9wBmA1D0SoU:plz+5i25anbVA1DyU

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1360216472013504663/sqs_P8SwWQTQfhaUAcKb-8L0gm293cIgWdXswY99Al9zzzdG7s-rLScodI1tj4tJB5L-

Targets

    • Target

      Insidious.exe

    • Size

      303KB

    • MD5

      8da327f6fdd14d482e3e4f1706c1ec07

    • SHA1

      32cad906c6707f1e2a3be3ef6c4ea1fc8828841f

    • SHA256

      241123897cdb67ffff90098d85012c28e7c0b31a14c6263398720f2bc7d21db3

    • SHA512

      ffa4776fb8638cbeb45099543305ceff769368e53c60e6de9ae3cb76078ba9fff13b8b3a7f655bcbd08af58f9a7e835e09c575966c9c15907bccd5b0f47ac3af

    • SSDEEP

      6144:plFT6MDdbICydeBjy5i25C9nb/9wBmA1D0SoU:plz+5i25anbVA1DyU

    • 44Caliber

      An open source infostealer written in C#.

    • 44Caliber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v16

Tasks