Behavioral task
behavioral1
Sample
1160-57-0x0000000000400000-0x0000000000560000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1160-57-0x0000000000400000-0x0000000000560000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1160-57-0x0000000000400000-0x0000000000560000-memory.dmp
-
Size
1.4MB
-
MD5
2de5c09aaccfd0a8d405fcc6a535ce9c
-
SHA1
f42a454cde6297b1901b6cf89a2b2312d17cba82
-
SHA256
8bee5499256001c7efbdd2735976326599723541534ce318508fcb08c627ed3e
-
SHA512
13765a06c64249d5324cb41a5a761796a86fa32b4868150abf6ef40b17db66a5e52b0c7e4d3864f7e0607d808e337ce9909e7ed675c02f35cebd4be58890e5a5
-
SSDEEP
3072:KZ71ehH+KPo1QDLBKSWPa5jnBYP/P70zU+dTWJbIOeHEbV:K/IeduLASrBYT0zUHJcOeHE
Malware Config
Extracted
colibri
1.4.0
Uniques
http://194.4.49.243/gate.php
Signatures
-
Colibri family
Files
-
1160-57-0x0000000000400000-0x0000000000560000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ