Extracted

• • Target

    792536cb7e72e25a03d2b9b2d54027106eb2003ab56f7104cd407f57693cfc2f.bin

  • Size

    425KB

  • MD5

    9e7322df010fcaf39555b79849014ff2

  • SHA1

    aa5f2d73b5dd6c0e6207b5cbb1b5d8dadff31008

  • SHA256

    792536cb7e72e25a03d2b9b2d54027106eb2003ab56f7104cd407f57693cfc2f

  • SHA512

    97455f588328c467523c676449716e480e8638015bab280d194104da44a563d528645f7175b0a3f81d9c4cb62d7560893b143a70361a5ef3418e9bcd2e17f9a5

  Score

  10^/10

  colibribuild1loadersuricata

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • suricata: ET MALWARE Generic gate .php GET with minimal headers

    suricata: ET MALWARE Generic gate .php GET with minimal headers

    suricata

  • suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

    suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

    suricata

  • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata

  • suricata: ET MALWARE Win32/Colibri Loader Activity

    suricata: ET MALWARE Win32/Colibri Loader Activity

    suricata

  • suricata: ET MALWARE Win32/Colibri Loader Activity M2

    suricata: ET MALWARE Win32/Colibri Loader Activity M2

    suricata

  • suricata: ET MALWARE Win32/Colibri Loader Activity M3

    suricata: ET MALWARE Win32/Colibri Loader Activity M3

    suricata

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  behavioral1behavioral2