Overview

overview

10

Static

static

AppSetup/Setup.exe

windows7-x64

10

AppSetup/Setup.exe

windows10-2004-x64

10

Resubmissions

29-11-2022 17:31

221129-v34ptadd4y 10

06-10-2022 19:02

221006-xpybzsaegm 10

05-10-2022 21:49

221005-1pa38sfgc2 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AppSetup(4).zip

  • Size

    2.0MB

  • Sample

    221129-v34ptadd4y

  • MD5

    f3feedca226cef053c9d0db9185e9ccb

  • SHA1

    1ecbdb50e242dcad111835dd9e55a22e7d29575a

  • SHA256

    9f7cf69159e759cb8f750a5d9c20edddde6a758da5293adf36253bc3dd699f71

  • SHA512

    0e41facf3598884982541c1a8925e5dfe9301b254ea86e08013c5f104bbc5b660fb3831b9461f44ac033398af59a338240f5be7c3bb23d14fefe4d02e4bf5af3

  • SSDEEP

    49152:B88YRKRZLAEhQmUSjXE5K2hVh82UotnMeY:BYRaFUeXX2hV40VY

Score
10/10
colibritestloader

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

test

C2

http://65.109.7.23/gate.php

rc4.plain

Targets

    • Target

      AppSetup/Setup.exe

    • Size

      700.0MB

    • MD5

      7c5d1c8213b4f6d0024271fef44e6cd0

    • SHA1

      207849a369dae9a6084850791e0ec53209cc928e

    • SHA256

      bde1ea677730594b57aec1799bb7a51bc1b821ea0f6fa1281127f94cc12445a5

    • SHA512

      d90f3b0054376d642e0d57f68a9cd54f8a29b893dfa4428a3a8280c0c93fc0c441b412a5367865d306a08a36720a9ed186bc290899f7c55341768188b7fa635d

    • SSDEEP

      12288:OGnwnjo3r9nWZQzjFeM6DJOjB9sTTHy832srZZUcCO5x9tWFHeQR8KeHj3Fuxkxv:OC9nYQb6VOcdFz9twRgb6kxChx47B

    Score
    10/10
    colibritestloader

    • Colibri Loader

      A loader sold as MaaS first seen in August 2021.

      loadercolibri

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks