Extracted

• • Target

    file.exe

  • Size

    657KB

  • MD5

    408866829065c70ccb93d6af75b2f04b

  • SHA1

    c2abb3f1434d1f1996dc6569f1d289eda41edcca

  • SHA256

    6c179c2b5cda41d940a552f19def20711f7389d3188d7646c45b7963f2049667

  • SHA512

    724ed56fc9409f77e8c804101f45de8ccf453642b59f124c647dc3ef5936ce2adbb74befdd5d1590cc3b9fe7ef1f9a864128b545ae5746cb822f22c19244af45

  • SSDEEP

    6144:VoxIpwTnoNlR/DU7yhezwmQsrmMxzG8pCoHM3g:VoxIpwTnoDR/DUmhwxQspo8VsQ

  Score

  10^/10

  colibribuild1discoveryloaderminerpersistencespywarestealer

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • Detectes Phoenix Miner Payload

    miner

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2