colibri | 379e068e45de6345985fc773f3118dac439845a9d853b9978536ff1870a5ae0b

General

Target

379e068e45de6345985fc773f3118dac439845a9d853b9978536ff1870a5ae0b
Size

181KB
Sample

220803-c1wx3sfcfn
MD5

0bd5027ed27e4adec49f683e97c2a7e4
SHA1

a08662d8fdc233d069529dcacf86907f049ecf79
SHA256

379e068e45de6345985fc773f3118dac439845a9d853b9978536ff1870a5ae0b
SHA512

976f6093ee3fab563a0ea41eb8e4004855f9b0fc192c2b6ea1dbaccba658478e902eb6f7e1d4beef30d355150bd97d0a0c48612a65f35609058854d969c8cb89

Score

10^/10

Malware Config

Extracted

Family

raccoon

Botnet

125a9422607402ad773f580d72e3170b

C2

http://91.242.229.142/

rc4.plain

Extracted

Family

socelars

C2

https://hueduy.s3.eu-west-1.amazonaws.com/dkfjrg725/

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Targets

- Target
  
  379e068e45de6345985fc773f3118dac439845a9d853b9978536ff1870a5ae0b
- Size
  
  181KB
- MD5
  
  0bd5027ed27e4adec49f683e97c2a7e4
- SHA1
  
  a08662d8fdc233d069529dcacf86907f049ecf79
- SHA256
  
  379e068e45de6345985fc773f3118dac439845a9d853b9978536ff1870a5ae0b
- SHA512
  
  976f6093ee3fab563a0ea41eb8e4004855f9b0fc192c2b6ea1dbaccba658478e902eb6f7e1d4beef30d355150bd97d0a0c48612a65f35609058854d969c8cb89
Score

10^/10

colibri dcrat raccoon socelars 125a9422607402ad773f580d72e3170b build1 infostealer loader rat spyware stealer vmprotect
- Colibri Loader
  A loader sold as MaaS first seen in August 2021.
  loader colibri
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- Raccoon Stealer payload
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Downloads MZ/PE file
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1