44caliber | 4349729a2113fee5266374063af1c423e79a5e0988a2c0092c17dfea5040f904

Sharing

Copy URL Twitter E-mail

General

Target
new update.rar
Size 6.1MB
Sample260910-x4tbksvdlf
SHA256 4349729a2113fee5266374063af1c423e79a5e0988a2c0092c17dfea5040f904
MD5 dfcde6daf151ac190250b2beecf92806
SHA1 8ab0e9bde87fef1d24d1dc1067921bb5963b7da9
SHA512 01e634de1b77fe4355f6ce7f72c072c32e2657fa2ff5e84bcabcc2ad54afcac7725eb56aa8f7b45725e619c168ebc7c185bc2c06e8362bca51c67be27785782c
SSDEEP 196608:mGre3kNgyh3SDfv2nt92p/oXW0pLAQU4rV+ZU4rGy:DeHjOt09uWsLA4BIay
TLSH
T1B056333DEF92BBC0A630505A8731B6F5AE69F15B7074508D17BD1F20CA9668198EC2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  new update.rar
- Size 6.1MB
- SHA256 4349729a2113fee5266374063af1c423e79a5e0988a2c0092c17dfea5040f904
- MD5 dfcde6daf151ac190250b2beecf92806
- SHA1 8ab0e9bde87fef1d24d1dc1067921bb5963b7da9
- SHA512 01e634de1b77fe4355f6ce7f72c072c32e2657fa2ff5e84bcabcc2ad54afcac7725eb56aa8f7b45725e619c168ebc7c185bc2c06e8362bca51c67be27785782c
- SSDEEP 196608:mGre3kNgyh3SDfv2nt92p/oXW0pLAQU4rV+ZU4rGy:DeHjOt09uWsLA4BIay
- TLSH
  T1B056333DEF92BBC0A630505A8731B6F5AE69F15B7074508D17BD1F20CA9668198EC2EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  new update/Insidious.exe
- Size 278KB
- SHA256 43d3ef07e0f83898dc59adfab88642b9b048b2a3d10b91b760331dea21b00458
- MD5 60115edbc14eb733dcd9376471f4eb3b
- SHA1 8c974018ee8583857f64b3f1ac60e69d56b8aa1c
- SHA512 5e000f7475860fcb442a00815673a532c852b8db1db90469075046797800da44e11feb3ef5175b59c5987e8b5369fb77fc68dd6e59a41aa601018f1dd26a91a6
- SSDEEP 6144:Zf+BLtABPDeHQfn54/T2kqqwyT0znD3fC79/x0aY+bhNus/l3ID0SGR:UHLr2kqqwyT0znrK1IDoR
- TLSH
  T1D0544B0027EC8B56F2FF5BB8D4B11265C3B1B466F97EDB4E6C44A4DD2922780D904BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery 44caliber spyware stealer
- Family: 44Caliber
  An open source infostealer written in C#.
  stealer 44caliber
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral3 behavioral4
- Target
  new update/Insidious.exe.config
- Size 161B
- SHA256 d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad
- MD5 c16b0746faa39818049fe38709a82c62
- SHA1 3fa322fe6ed724b1bc4fd52795428a36b7b8c131
- SHA512 cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c
- TLSH
  T1C9C08C5940247C2BDC224F239260C925FBF83262A424000CE06BAB6A0A2015E8206356
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  new update/Insidious.pdb
- Size 865KB
- SHA256 4d187db28c644a2b523cafb20c88e88eebb7b09e0909ebb6cd0003c9ae456fbe
- MD5 4938d87aa51afa5e93a6db66d06f81b6
- SHA1 3507e12750b395d82092a826d54b14a9078ac524
- SHA512 dab0512e1ec73073e8f1d1ee3ec141ad0b0e6bf2996861b4a81c982da54fac6ca2298cba76963c0ad484854536065c4b0041e013be926959819b32154749b53f
- SSDEEP 6144:5Zzx2IEQ/lxfPgHGGNePeydTW1rphltJ1a7fwv9uUNIzksXz5aHZr7fwv9UksXzB:jBtlgD0tuv9DNIzkdQv9Uk
- TLSH
  T19A15A36BBB80DE73C0A5C5B826EB8F1E0338E1885F43A78F6755696D3DC336A1D42254
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  new update/Newtonsoft.Json.dll
- Size 704KB
- SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
- MD5 24704261e701b49b51e40c1292ed149e
- SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
- SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
- SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
- TLSH
  T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  new update/Newtonsoft.Json.xml
- Size 716KB
- SHA256 a9c6be122c118de22c72f9f9e5d9ef787492d24ad91d2c9c23b8d1f0e5f2ef3c
- MD5 93b7c648a3d6ae4a25fb115482afcf2c
- SHA1 3acedace379b7a9b889c7d4e25b537eb5453bff7
- SHA512 12d052df880c8b7b4a3b089ee289da37d10bb95dcdecaa2affa5c6acf0dfc81c1a8dedc911a37c5ae21d51f657a92bf4979582a7c295393a09c99d2eab8db993
- SSDEEP 6144:XqqU+kykVk5aG0rH3jGHdl0/IVEIHXpgVIeR0R+CRFo9TA82m5Kj+sJjoqoyO180:DUp
- TLSH
  T1CEF4DF2577C4CB220C7A012A4D1CF0C5FF205AB316192CA635CC5DDB9F7AEA252FB6A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  new update/System.Data.SQLite.dll
- Size 439KB
- SHA256 77dac4e1aa63161d6aff363030a801945d6b8d5b823a6b460b2c2be9ec38d3b7
- MD5 0d56ea52b6da5eb637d5e207f241d35b
- SHA1 5ba0c52d9d60b34ee74d013f8389804029e60f0e
- SHA512 72037f3b8934bb43fb3a4c396dc7c82d3dba3f6a9979522f2f38bdabdfea29a73e4db3fa544b7d43de9314fb21a78f1e006c1fb18a58b75a7c0b83d7ea6d398c
- SSDEEP 12288:iO69tgrf5V0KlhD2oU/+zFjhe+q9eJSMLprv3lRPhFrFckvUl7zFquovh1sSKQWk:iO69tgrf5V0KlhD2oU/+zFjhe+q9eJSW
- TLSH
  T17CA46BA027EC1109E6FF56B8E87164419B70F553AA77C34E74C4A1EE2C22B805E637B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  new update/System.Data.SQLite.xml
- Size 1.2MB
- SHA256 1b6c751c39881f02db601b7cc7b2e54e122f4870955e06ddb521314c20d23016
- MD5 5f2a206d40d77aed77035c2c1921a60c
- SHA1 19e2b85dcbc34641d96f76d7de5bbacd1a85bee2
- SHA512 2ad7c5b6b38a0018b271b47190049842998a13b026db41777ba915c4a4e2f4def9a922f435bd853ece470c2c303cd28b26c180d34aeaa2f964dc9840cf0538b5
- SSDEEP 6144:sBKJedf2KkuJ4WwWr2ggmqVBG8FD6L8J1U1IQmcNTCqm9wmAl:+L
- TLSH
  T11E45FEA837CA9E110873010B693CF0C4EE395967E556886238CD7E57DF76CA263BF990
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  new update/System.Security.Cryptography.ProtectedData.dll
- Size 22KB
- SHA256 e4a756ed35c4498dcd2ed1d9166cd5cbddc48b902f15efbe6251d1d00f742b11
- MD5 4f2e50af9316aa6619c843b6c8377798
- SHA1 f1ce83924aeaf0639f61ba3dfe452205e4c82164
- SHA512 02da908b9f993e68676e5b1344fb29626a51bdb582e20a2d80a64c1075291646f549f336710b173a075e6b15b3f786a568db005e16381732728af5f4e0b557aa
- SSDEEP 384:e/MeVM6j9nYD2PoXLGU+rHWAgp6jDWX9/hljHRN7WSP3U0R9zeArmS:e0ea2kLpEW9DjY49zBaS
- TLSH
  T16EA24A65973C937BDD6B0D7196B4D5623E38D3852A13CA2E6284F50A1C277CCEA30739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  new update/System.Security.Cryptography.ProtectedData.xml
- Size 13KB
- SHA256 e6ddd6bbb75a48aa01424897efa3181effc6ddd2951e8eb45fcfeaff70b075f0
- MD5 5481f791af3e1de2ca362d98772fa7b1
- SHA1 1a5df931e6b2a70e45ce0b4609bb84cdc546db36
- SHA512 a361b5c7e4c5e12268b4b33308b53549ef00967bf12348e0d54d2989e52ed9f76f483a7fb7e91b2d83651a6a88295b6d49fd9cbea7c6ccfdbe2029038e458519
- SSDEEP 384:Yr0QL8Ue5iU5c/8s5BW84q5H+i8r2tiH62viH5K+z8U:Yzw5K5F5W45H
- TLSH
  T1D2523230B7C1861551E3135A1838F048EB31F72E60559D06FECD8A66B7AA538F3BB897
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  new update/x64/SQLite.Interop.dll
- Size 1.9MB
- SHA256 1111916dc329a13bd627b2cd90c9b2263de9923fd0bb6059c69c52332f360c37
- MD5 4930777866b1fdaed2ab80b0fb8793b6
- SHA1 e2686b9ac7c3867c644902805142f1f42bae7645
- SHA512 d294e9d638fb6d579fdfd69a9f098b2d8087fc6c1c240496cc99804980284352299b52b9a2d6b1d1289ffdc5f5ecf364e67eb32e7b4a9a8ddf20c723f9fa28d5
- SSDEEP 49152:tQ/IZ0sF2Ou+pqnX3lJ1nCHmWbk8d7hLJ:tQ/rHnkJ
- TLSH
  T1B4958D4BB2B400DCD6A7C17CC6475B0BE7B174051754ABDB07A486AA2F23FE516BE328
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  new update/x86/SQLite.Interop.dll
- Size 1.5MB
- SHA256 553693b15bda4bbf7788bee09b8bd325ffe4db151686f432194c58e15b9b4f1e
- MD5 9ca5b1d02e334ffed34d80ae2b02490f
- SHA1 84015d25373e1ca3a17e85fffef2bf1738bd172c
- SHA512 b66bba909c8ebbd3aac071ad0599c952c27503d5414ebaf3cae7d7a40eca6cdc83b1dd438e4e9e72985ff96e4f3c1d54e9dbf1109ac0b74d2777a73c441507fb
- SSDEEP 24576:m99D5xnu3JyrgBD+0AcwN12xVRz2JG4k7P4IYvbb8PBSB6LHLcZ4TB4v81R1k:mf5xnu3+g3wWPYkPk4HLDv1R1k
- TLSH
  T1BF759E12FA8380E1EDD910B152FE2FB71D78A219472858E7E3D02CA55A311D3B67E39D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  new update/x86/SQLite.Interop.txt
- Size 1.5MB
- SHA256 553693b15bda4bbf7788bee09b8bd325ffe4db151686f432194c58e15b9b4f1e
- MD5 9ca5b1d02e334ffed34d80ae2b02490f
- SHA1 84015d25373e1ca3a17e85fffef2bf1738bd172c
- SHA512 b66bba909c8ebbd3aac071ad0599c952c27503d5414ebaf3cae7d7a40eca6cdc83b1dd438e4e9e72985ff96e4f3c1d54e9dbf1109ac0b74d2777a73c441507fb
- SSDEEP 24576:m99D5xnu3JyrgBD+0AcwN12xVRz2JG4k7P4IYvbb8PBSB6LHLcZ4TB4v81R1k:mf5xnu3+g3wWPYkPk4HLDv1R1k
- TLSH
  T1BF759E12FA8380E1EDD910B152FE2FB71D78A219472858E7E3D02CA55A311D3B67E39D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26