General
-
Target
9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc
-
Size
602KB
-
Sample
220901-ref23aggb2
-
MD5
913240d24664aeeee23dcf389d6f2ce9
-
SHA1
730b13fb29347ee478d79195e49977de41ed740f
-
SHA256
9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc
-
SHA512
8a7e73fc3214dccdbea8a5f6a70b40f233719b2a7ce8bd205d3be2f01c93412d788fea071020dbbd76d79c43352fb71f60dab0e8eec18b159d5d0f970ad7bde7
-
SSDEEP
6144:up/J6DzcxdUf4/p6gj59aG5Ye5fYNYPk30QRyzpGa+IZ:up/J6DzudUw/t9Ge5fYlEQRyzwrG
Static task
static1
Behavioral task
behavioral1
Sample
9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Targets
-
-
Target
9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc
-
Size
602KB
-
MD5
913240d24664aeeee23dcf389d6f2ce9
-
SHA1
730b13fb29347ee478d79195e49977de41ed740f
-
SHA256
9e5ee80ee0e72b51abc4491e80fb8cf07a9d9c22b083d08f1db24ffae89517dc
-
SHA512
8a7e73fc3214dccdbea8a5f6a70b40f233719b2a7ce8bd205d3be2f01c93412d788fea071020dbbd76d79c43352fb71f60dab0e8eec18b159d5d0f970ad7bde7
-
SSDEEP
6144:up/J6DzcxdUf4/p6gj59aG5Ye5fYNYPk30QRyzpGa+IZ:up/J6DzudUw/t9Ge5fYlEQRyzwrG
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-