Extracted

• • Target

    06af62965ce16e6f497c93feb98e9a0e63f7f05853c519ca84de943182da371e

  • Size

    8.2MB

  • MD5

    3945a1aabe76ee6d60ccf79f24ca5487

  • SHA1

    f524ed975bc76b1f8c1aee43b2a82c766778b3ee

  • SHA256

    06af62965ce16e6f497c93feb98e9a0e63f7f05853c519ca84de943182da371e

  • SHA512

    1f7cfde412bda3096bab0696b7b9de709b25d25b741e67140eb68a55b8e821a745f957a9e08aaefd1aa48ffd9bd1e395a615123607f67d0ac3f62c929776794a

  • SSDEEP

    196608:YBz5EaignhjIfak4XMaiz8qL1HZiC1GnQmf4y:G5fhAanXMt8WRZp17q

  Score

  10^/10

  colibribotloader

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2