y<G5l�*%��TB0��.V �H9�����#�?�U�xj��sM.�\]�=�u+�,R���2���wY�`�6up�ȁvݣ���1�eJ1���Ȼ� X��\=qm��mV$�6Z7�`2�76�\F��$�5G���E��U\Z�X���a4o;��2̈́��]��_gA�-|L<N���<r��4�Z��Y��x�^M�5���H��F��K�����]�"ܚ.��YV�"f��Ǖ�w�1�ݲ��&翝z݅X5�ٯ���Ɔ�2���t��oN�ϺX`K{ y>.�]��-� BV�������֘$�CמG}tb ��7t����\%U�+k5aiؽ�@��,����0�̬�������1z&��v���4���v"�U��}\�M4~�?�Ń�mro�+>n���TL�3[���Z�����H��Zԫ��4��z/Γ�P�qk!������vkFr�k�Z���~�i%,�h̕�h���P�=��1��fb�0F�/�(��/��j���ޠԘ{6*l�5]�羼/;��*�7��y+7�Wa|ٹ�ʮ�d.�kiP����i�M��!��uB��ç�B";��=��t�������5�eY`��Չ��`�F;��^��mR�� '���^�l����U��{���<�W��1��� ĭ��8;#w �m4lm.�g�#��|����N�8�r�O�to��b§��SM�Q-��\��:U�&,$2I6>����+��v���."�l�[�]��t����i����\6�vAX#z�Y�{$ȝD��^%�������e��N߱���;.���ڱpwV2_��; ヰ莈6;IZ�q�E�/&���)ʺ��oÉN|�Z[y��(��Q���JQV��8�� l�c�h)s��-�s��b�5�>M��ύ���/)�T���8�7�,w )���Rl� �RvA�6b<OϮ���^�'F�H ��:� �{sF6�X�d�cy=� ����}05`�8��\�#B�j�8�*ۼ��-�A�~nf��ɧ��ۡկ�bm<��xC�@/o�d/е�˄�c��1����2���*�gݦ�L2U 86;�|�;����-3��LFv��0qΝy���?�����P��t�Fzl3ә4�U�s��"u�q��.%2���TZ�Ks�0'�k�QV@,�ƘzԚL����=�V��xl���{mS�P9��2�*��ki�C����C����m[��$uM����"���E���$�g�K�o)�L� (���%ީ�]h�_Q�������EI �?m�r/�[�<�e�Tu�-/�]?���0*R���/���q*�A� ����nC-��.T�tw<ڔ�7$���i@������B��p�@�B͙��`0R��\'LXf��Z�m;��9�K�����9#����#eZiF�:�o��W�W)�A(5)�=Z��Lb5$�Չ�g���o��vƅO���k�9�ە���`���������q�E��Wn�`�����"@����������˨^�d��m�PVNu�!�h�����F�N�!\���ϕ��<��`�j��c��E��٠|V�*�������NO�$g��ci��+�N+U�������a��ή�4/�Ā�1%�l�D����m�����b4H���`�K���?�^��W��(���� �5�ˎ����R��ܕ..(m� �[ȵ�qE��釮������2aG��7���l�(I������w�:����z*�j@2���zx7�*VR3�n�� �X����W[phu�ne���^x�����t�Od�>��Bo��j���*�3�� ��5v��z_�Q���?=w͇d�5Ӳ��(��7<��,7ZY�^�A��?��겕?��k���H�j���"�l�8���lw ������&�x�tƑ\��'֗2�����%QW�!R��8 :G�F�b���>�!����*5b6WJX�; 4�����e;]{ �7�� �����oFh�"3 Z��j��2Q9�� �Җ�U���ѢNS:q�Y�f�Ո��x�Ѵ�?�zH���}mJ�R�پ+ ���2�CJ,:�P�)��H?̮�IA���@*S^d��]�j��xC��� -� 6�h��2{�����$�<�EIu`t�Ac~4vt�@��5-��m�.F �.����*��Z5:7��=��(}��*A6F3tm6@Y��1��HWx����5�!�����m8�k�W�CH��{E�p�jH�?���oK��XyJ����F�����L��o��ǖ��9�0 ��328��W�|n"��v�| ��'��:�D��8��V��7Mn�`�l�ޗ �T�S��>��O�I+`ՍD��[���r���ww�S�a����|�E?c���vZ����ҥ Wb�I��@'�Q��ߴ��� G����PU�L�2h���f*9�U��1�Z�s~��ڈ*�>��$ȶAxz\�8r����'S7�V{�(�st�ق�N�_Iit^Y����}Ss���Ū�L��+��I8�ا��4�x�����Wqy���k��H��Ђ��^B �;�]����7#��=�h�����e|�+Bz��!w�as� dd�_=x�\�y1At�t��N����g���,g!�q��<��W��rnb)�m��n���֠0vؿ�.�5�����!}�z=�\��U>�sBJ��r�#/�Tޚ"���6���м�Ao��s�tl�h8�]Wu�3IȺd��Cd��uM�Z���ե�c��7�Q_ꨶ�0���<���V@�+dr��E�|�*\@a��G��TS0^%J�N[8d���'�u�?DFF��~ƽ�C��?��d�<���d��rz������|S�}[M��a��7xR�Z��=+C/wHi��� 1�1��mDt�#/�G ��C=�(h<�c�n)�� ��mтU|?1�9Q��_��H�q������j}�TY��j*�l�>N +�L�gHO*gШQ���ryH4MAEQ~����O}�Y���k�n1��}��n}H-�yd���h���;�� ����h�G�̞��"���|�w�$N�xQ>$��W�)�ݔ:LBD���Y��'� W&��§0���R��-�ﻗ �Bَ���t[Daݳ�̉�<�kr\h��$X�g��}�D��e��;?�����v)_ d����VѬ���DwV�7Ý���-�H�xG��쎮���}v�3c_�I3x�{��@i#��}��* J�������jJ�"�T��a��1!�Ie�n��g=�a�����ߛT������λ�����V0(%��SὬAy�M�l�<Mʨw3�!WAV��S-/��} �Qh2s�Sw��>g�<�ԃQ�c�X��Y���F��q�Q�]I$F �s}�
Static task
static1
Behavioral task
behavioral1
Sample
Colombo_debug.exe
Resource
win10v2004-20231023-en
General
-
Target
Colombo_debug.exe
-
Size
8.7MB
-
MD5
5789c360acd9097bf946fb296d30eb19
-
SHA1
a347ae43b25000269673a5bf9a841cbb9e1b42fa
-
SHA256
4147ffbe9250d41949e0c7676e6484e056ec8379a6eb5e2ee155f1f1ada3164c
-
SHA512
051a1d55b10af395b75c7d6000dd8ee68acb6eae482975cc7873cccc9421b27bc20c24113d3c4aec2e7c304eb92bdf8b674042091fd9cb5e61e74e6832aaf1d4
-
SSDEEP
196608:m6QUmsgqJKEorFmLYm6LNrBYspOK8MfAqiElNOp1LWAxaHYjVN4aRM:1QfsjsrF46LNfOKDvnm1LWAXhNG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Colombo_debug.exe
Files
-
Colombo_debug.exe.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 75KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 33KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Colombo.pyc