Resubmissions

17-01-2023 10:21

230117-mdtjjsec63 10

17-01-2023 06:18

230117-g2lkysfc8s 10

General

  • Target

    mars-wallet-64-1.01.12.0-8438.exe

  • Size

    397KB

  • Sample

    230117-mdtjjsec63

  • MD5

    581d545c4a3d99f4fb5b92752610e950

  • SHA1

    66deede4f00f1a76cdcb9e52c9a42b371875be38

  • SHA256

    612580febe9bad2c60ab8ad8564a38680cf415581c542e5e6109e680dc5e9d15

  • SHA512

    ef036240c359453850fc5ec4bddeddff0cf7d8c5b43ded1ae620cd76de9c7fbc07533ec859236c554e97c7b2fbf286f6914630b6f36a89620139e6bee2bc5c35

  • SSDEEP

    6144:ytN60S22Iq0NKGr8QsPgwKh10UfY2TDRK13yOz4RXvSTmE:ytN+ONKM8GwA6GJTVC3yO5N

Malware Config

Extracted

Family

colibri

Version

1.3.0

Botnet

bot

C2

http://176.113.115.240/gate.php

rc4.plain

Targets

    • Target

      mars-wallet-64-1.01.12.0-8438.exe

    • Size

      397KB

    • MD5

      581d545c4a3d99f4fb5b92752610e950

    • SHA1

      66deede4f00f1a76cdcb9e52c9a42b371875be38

    • SHA256

      612580febe9bad2c60ab8ad8564a38680cf415581c542e5e6109e680dc5e9d15

    • SHA512

      ef036240c359453850fc5ec4bddeddff0cf7d8c5b43ded1ae620cd76de9c7fbc07533ec859236c554e97c7b2fbf286f6914630b6f36a89620139e6bee2bc5c35

    • SSDEEP

      6144:ytN60S22Iq0NKGr8QsPgwKh10UfY2TDRK13yOz4RXvSTmE:ytN+ONKM8GwA6GJTVC3yO5N

    • Colibri Loader

      A loader sold as MaaS first seen in August 2021.

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks