General
-
Target
792536cb7e72e25a03d2b9b2d54027106eb2003ab56f7104cd407f57693cfc2f.bin
-
Size
425KB
-
Sample
220524-ph5hqaabc2
-
MD5
9e7322df010fcaf39555b79849014ff2
-
SHA1
aa5f2d73b5dd6c0e6207b5cbb1b5d8dadff31008
-
SHA256
792536cb7e72e25a03d2b9b2d54027106eb2003ab56f7104cd407f57693cfc2f
-
SHA512
97455f588328c467523c676449716e480e8638015bab280d194104da44a563d528645f7175b0a3f81d9c4cb62d7560893b143a70361a5ef3418e9bcd2e17f9a5
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Targets
-
-
Target
792536cb7e72e25a03d2b9b2d54027106eb2003ab56f7104cd407f57693cfc2f.bin
-
Size
425KB
-
MD5
9e7322df010fcaf39555b79849014ff2
-
SHA1
aa5f2d73b5dd6c0e6207b5cbb1b5d8dadff31008
-
SHA256
792536cb7e72e25a03d2b9b2d54027106eb2003ab56f7104cd407f57693cfc2f
-
SHA512
97455f588328c467523c676449716e480e8638015bab280d194104da44a563d528645f7175b0a3f81d9c4cb62d7560893b143a70361a5ef3418e9bcd2e17f9a5
Score10/10-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
suricata: ET MALWARE Generic gate .php GET with minimal headers
suricata: ET MALWARE Generic gate .php GET with minimal headers
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
suricata: ET MALWARE Win32/Colibri Loader Activity
suricata: ET MALWARE Win32/Colibri Loader Activity
-
suricata: ET MALWARE Win32/Colibri Loader Activity M2
suricata: ET MALWARE Win32/Colibri Loader Activity M2
-
suricata: ET MALWARE Win32/Colibri Loader Activity M3
suricata: ET MALWARE Win32/Colibri Loader Activity M3
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-