Overview

overview

10

Static

static

cunp.exe

windows7_x64

10

cunp.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    cunp.exe
  • Size 24KB
  • Sample220203-rvqansade6
  • SHA256 1b2eaff481b083525a42635e86bbeb6ca0e7c1c9c3d880ba29754b9a2277b962
  • MD5 SHA1 SHA512
Score
10/10
colibritraffic_docloaderpersistencesuricata

Malware Config

Extracted

Family

  • colibri

Version

  • 1.2.0

Botnet

  • traffic_doc

C2

  • http://188.130.139.47/gate.php

Targets

    • Target
      cunp.exe
    • Size 24KB
    • SHA256 1b2eaff481b083525a42635e86bbeb6ca0e7c1c9c3d880ba29754b9a2277b962
    • MD5 SHA1 SHA512
    Score
    10/10
    colibritraffic_docloadersuricatapersistence

    • Colibri Loader

      A loader sold as MaaS first seen in August 2021.

      loadercolibri

    • suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

      suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

      suricata

    • suricata: ET MALWARE Generic gate .php GET with minimal headers

      suricata: ET MALWARE Generic gate .php GET with minimal headers

      suricata

    • suricata: ET MALWARE Win32/Colibri Loader Activity

      suricata: ET MALWARE Win32/Colibri Loader Activity

      suricata

    • Sets service image path in registry

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks