Extracted

• • Target

    566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0a27c61bd92f511efe76

  • Size

    794KB

  • MD5

    9c038c34e4d37410cecb1f20f90984d5

  • SHA1

    ad16dea0d1f1d3eb45e8d8e1a040e42110ab1bec

  • SHA256

    566584a10ff7bd4442abc0e13b0f4dc263bbe61a0fbf0a27c61bd92f511efe76

  • SHA512

    5e5a5b357fe902b76b8c76a534904cc4ab588d9e558c1c5a6ad935326fa532873a27f6b1c9dd6c62aecc84ac791cc2442c9ef41c4151077d7499ed7c7e59b961

  • SSDEEP

    6144:gHsV9Ig0yuLxcxxHz9Fl5iD4n3HVxx+BcUg+4oyss3MAy8IfSEA6gsumifLzJ6:4svBPnHJ5iERUghGUMAOSElgsumiT

  Score

  10^/10

  colibribuild1discoveryloaderspywarestealer

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1