Extracted

Extracted

• • Target

    b2e3670b7a2ab39f8e1041e16f9625577eaca98c78885475e7980bf035b493de

  • Size

    213KB

  • MD5

    3299d71662eeafeb7edd52684d2cd389

  • SHA1

    2087919eb78e7523f6aacbed32dd3a3b2bd72e73

  • SHA256

    b2e3670b7a2ab39f8e1041e16f9625577eaca98c78885475e7980bf035b493de

  • SHA512

    3e527ce723d8e1248d835a3eb88d6c6bf2c887cb54eac2de9a0536450b289e3d405b05330854f7207f7eeb345a09d5cebda972ff2538ed5e7dcc5e2f5b81a8f6

  Score

  10^/10

  colibriredline@mahouny23build1infostealerloaderpersistencepyinstallersuricataupx

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • suricata: ET MALWARE Generic gate .php GET with minimal headers

    suricata: ET MALWARE Generic gate .php GET with minimal headers

    suricata

  • suricata: ET MALWARE Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI)

    suricata: ET MALWARE Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI)

    suricata

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata

  • suricata: ET MALWARE Win32/Colibri Loader Activity

    suricata: ET MALWARE Win32/Colibri Loader Activity

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2