Overview

overview

10

Static

static

AppSetup/Setup.exe

windows7-x64

10

AppSetup/Setup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AppSetup(4).zip

  • Size

    2.0MB

  • Sample

    221005-1n57zsfgb9

  • MD5

    f3feedca226cef053c9d0db9185e9ccb

  • SHA1

    1ecbdb50e242dcad111835dd9e55a22e7d29575a

  • SHA256

    9f7cf69159e759cb8f750a5d9c20edddde6a758da5293adf36253bc3dd699f71

  • SHA512

    0e41facf3598884982541c1a8925e5dfe9301b254ea86e08013c5f104bbc5b660fb3831b9461f44ac033398af59a338240f5be7c3bb23d14fefe4d02e4bf5af3

  • SSDEEP

    49152:B88YRKRZLAEhQmUSjXE5K2hVh82UotnMeY:BYRaFUeXX2hV40VY

Score
10/10
colibritestdiscoveryloaderpersistencespywarestealer

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

test

C2

http://65.109.7.23/gate.php

Targets

    • Target

      AppSetup/Setup.exe

    • Size

      700.0MB

    • MD5

      7c5d1c8213b4f6d0024271fef44e6cd0

    • SHA1

      207849a369dae9a6084850791e0ec53209cc928e

    • SHA256

      bde1ea677730594b57aec1799bb7a51bc1b821ea0f6fa1281127f94cc12445a5

    • SHA512

      d90f3b0054376d642e0d57f68a9cd54f8a29b893dfa4428a3a8280c0c93fc0c441b412a5367865d306a08a36720a9ed186bc290899f7c55341768188b7fa635d

    • SSDEEP

      12288:OGnwnjo3r9nWZQzjFeM6DJOjB9sTTHy832srZZUcCO5x9tWFHeQR8KeHj3Fuxkxv:OC9nYQb6VOcdFz9twRgb6kxChx47B

    Score
    10/10
    colibritestloaderdiscoverypersistencespywarestealer

    • Colibri Loader

      A loader sold as MaaS first seen in August 2021.

      loadercolibri

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks