Extracted

• • Target

    c3a66975d641ba4e96f13e3bb1f22eeb8651376ff7414fbf1cf79f35f97a5d74

  • Size

    579KB

  • MD5

    a1812daa569e712fc42759a6cf38b2f3

  • SHA1

    b769a3eaafef5be2ba76aaf07d086a113456366a

  • SHA256

    c3a66975d641ba4e96f13e3bb1f22eeb8651376ff7414fbf1cf79f35f97a5d74

  • SHA512

    adb06797bad3ea9fc34649e884b6d5477b31ef2026242019052b9924d86cf39320bb0471afc0f9ec9cfceeaf5bbc0febc28b11b4fa06f25e1d0e067105b5f5ee

  • SSDEEP

    6144:32rLzbzbZct2dTJs4vhjhxr+SGc3Wd1dsuv:3inzVctadvhjhxaSHWdIuv

  Score

  10^/10

  colibribuild1loaderminerpersistence

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • Detectes Phoenix Miner Payload

    miner

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1