44caliber | Insidious[.]exe | Triage

Sharing

General

Target

Insidious.exe
Size

303KB
MD5

8da327f6fdd14d482e3e4f1706c1ec07
SHA1

32cad906c6707f1e2a3be3ef6c4ea1fc8828841f
SHA256

241123897cdb67ffff90098d85012c28e7c0b31a14c6263398720f2bc7d21db3
SHA512

ffa4776fb8638cbeb45099543305ceff769368e53c60e6de9ae3cb76078ba9fff13b8b3a7f655bcbd08af58f9a7e835e09c575966c9c15907bccd5b0f47ac3af
SSDEEP

6144:plFT6MDdbICydeBjy5i25C9nb/9wBmA1D0SoU:plz+5i25anbVA1DyU

Score

10^/10

44caliber

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1360216472013504663/sqs_P8SwWQTQfhaUAcKb-8L0gm293cIgWdXswY99Al9zzzdG7s-rLScodI1tj4tJB5L-

Signatures

44caliber family
44caliber

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Insidious.exe

Files

Insidious.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\176re\OneDrive\Рабочий стол\44CALIBER\obj\Debug\Insidious.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 301KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ