General
-
Target
8a5cd9512305bb139a15cf0a2405a870cf028026279f17adcf6c6bda89a1b285
-
Size
488KB
-
Sample
220902-e7t36sgcam
-
MD5
697c01dc85e4648b055562ab63a79da3
-
SHA1
dcb28b96b182ccdc09008cfb930a2100a7eeca60
-
SHA256
8a5cd9512305bb139a15cf0a2405a870cf028026279f17adcf6c6bda89a1b285
-
SHA512
70de2b1c8e6b7a2b201d02b90719477d0d555d103d6fb7079819c428db522649a8cc2d9a8f8ab7131648acebed1a833287128fe97ab767f948e3ec9d1d7a7baa
-
SSDEEP
12288:Nd1lPhRRJ0HpYxSmTz+mQWJ365QC7r2N7E6s:jjRJ18mntrJ097r2N7E6s
Static task
static1
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Targets
-
-
Target
8a5cd9512305bb139a15cf0a2405a870cf028026279f17adcf6c6bda89a1b285
-
Size
488KB
-
MD5
697c01dc85e4648b055562ab63a79da3
-
SHA1
dcb28b96b182ccdc09008cfb930a2100a7eeca60
-
SHA256
8a5cd9512305bb139a15cf0a2405a870cf028026279f17adcf6c6bda89a1b285
-
SHA512
70de2b1c8e6b7a2b201d02b90719477d0d555d103d6fb7079819c428db522649a8cc2d9a8f8ab7131648acebed1a833287128fe97ab767f948e3ec9d1d7a7baa
-
SSDEEP
12288:Nd1lPhRRJ0HpYxSmTz+mQWJ365QC7r2N7E6s:jjRJ18mntrJ097r2N7E6s
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-