colibri | 41b8e7e2d6b226268c3e95dc9ec3f897b60d3bc89daeb743eb585568ff034454

General

Target

file
Size

489KB
Sample

221012-tfm8waadgq
MD5

586a9c5e9e255f1153e3b8af5cc8daa7
SHA1

459cf021625581474a464271d98cd065c1bd4f17
SHA256

41b8e7e2d6b226268c3e95dc9ec3f897b60d3bc89daeb743eb585568ff034454
SHA512

ab0facd667688022d251dca8c1bfb43ddfad7b53609335dec6065e690a57ba4014d2198c56ce3f23b1c24b56c18ed1b58a1d02395bab5f97883e48f7913758c6
SSDEEP

3072:6VkgE+24QtMsYDJ0tqI6tQfX3C0slMpSHHYHbcuqXJIjG9kJjN2yDXuWdCPBnT9B:6VkA2x6tiXUMpGuwIq6tEyDeWWnJF

Score

10^/10

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Extracted

Family

marsstealer

Botnet

Default

C2

79.137.198.51/88.php

Targets

- Target
  
  file
- Size
  
  489KB
- MD5
  
  586a9c5e9e255f1153e3b8af5cc8daa7
- SHA1
  
  459cf021625581474a464271d98cd065c1bd4f17
- SHA256
  
  41b8e7e2d6b226268c3e95dc9ec3f897b60d3bc89daeb743eb585568ff034454
- SHA512
  
  ab0facd667688022d251dca8c1bfb43ddfad7b53609335dec6065e690a57ba4014d2198c56ce3f23b1c24b56c18ed1b58a1d02395bab5f97883e48f7913758c6
- SSDEEP
  
  3072:6VkgE+24QtMsYDJ0tqI6tQfX3C0slMpSHHYHbcuqXJIjG9kJjN2yDXuWdCPBnT9B:6VkA2x6tiXUMpGuwIq6tEyDeWWnJF
Score

10^/10

colibri marsstealer build1 default discovery loader spyware stealer
- Colibri Loader
  A loader sold as MaaS first seen in August 2021.
  loader colibri
- Mars Stealer
  An infostealer written in C++ based on other infostealers.
  stealer marsstealer
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Colibri Loader

Mars Stealer

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2