General
- Target Insidious.exe
- Size 303KB
- Sample260327-h61fcaby8k
- SHA256 c3b087fd9a8af04cbb9352982c9e201e95f88ee09a07642f6a3e3a732a357424
- MD5 c339d3bf332e2c6ba60c731a31563d32
- SHA1 13717cfac36b10aac04b063cfe7fb3027b324aca
- SHA512 40cc1d7a7ea545ef28a3be76163bc0dcdff2769786a5dadec639fc780c2be96a6bc9f98aae43f3fb744431fec8cd23aeadd71cd1bb65f6558d39272099a125cd
- SSDEEP 6144:pdFT6MDdbICydeBvRaifWp93dumwvmA1D0UuT:pdzJaifWz39W1DST
- TLSH T11264380827F88A65F5BE9BBDC0B551608371B462B83FDB4E1EC560EA2D32350CD49B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
44caliber
C2
-
https://discord.com/api/webhooks/1486988017863491595/ZA9Sc1f_JGd_Gc1J9s9Fmaj1Kqp_qVkyDhVlVMGseqx3NCaA39W2mvlCFgAdCJYRUVrw
Targets
-
- Target Insidious.exe
- Size 303KB
- SHA256 c3b087fd9a8af04cbb9352982c9e201e95f88ee09a07642f6a3e3a732a357424
- MD5 c339d3bf332e2c6ba60c731a31563d32
- SHA1 13717cfac36b10aac04b063cfe7fb3027b324aca
- SHA512 40cc1d7a7ea545ef28a3be76163bc0dcdff2769786a5dadec639fc780c2be96a6bc9f98aae43f3fb744431fec8cd23aeadd71cd1bb65f6558d39272099a125cd
- SSDEEP 6144:pdFT6MDdbICydeBvRaifWp93dumwvmA1D0UuT:pdzJaifWz39W1DST
- TLSH T11264380827F88A65F5BE9BBDC0B551608371B462B83FDB4E1EC560EA2D32350CD49B67
- MD5 SHA1 SHA512 SSDEEP TLSH
44Caliber family
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.