��Z�饪��o߿�T��~3T~C��>��&���#�s4%���..l��&r�5IF?�� �pŒ0=�O�E:us7�X�������+�)�e��Ϳ�@��t(��a�G�w��[\���@=��M/F`��nx�g*���[_2��5���r��#�|�K�9[�؋J���y|�{�g���n�;���t$�����3�6�*qk��_9/x�������ouS�;��QL�#�3=�zTh{�?�7!p�jQ�nf奞��� y�!�ykQ�̧��)����?t���2sb"P G�A��'ff�*>0��ii�R?&f�&�6�o�̩6�]�B{���VF}^���CҤ�!M:r*�-h3����a�h�H,��>�j�$�$��Ǧ���umbYsK#*'�h2z~��a4YU�}d�ʐZzt1�}[���+�(),c��,�w���-~cfCM.����|1! (��>�s�e�5��kV��Porԓ�Ϻ� ��?�$ZU8�%��&�mge��J)�_�1������~�<�Z��`t�~?6�Z����z5h�� :I<��+<Td@���=�*d!OKo��T:�`�j#��~�4&W���l\�Y�HE��wd��8S:{�� ";Wҧy� �������G��.m9R������n8i�5�� BCD���c�H��GtڟR��SI���3�[�xUF�/B,�� t����d�D�VlWІ�6��H�'a o�Qh�微3}�2V�9������<I����c�X�ZV (vp�%��ͨ�;k�0:X/�I��-9pY6D�맬!��D|�;f�k�/�h�8$��P'��S�����~��OGj5�_�����(��5d�)>��I�Qv !u��Z���͙�qʮ�τ��A>u(�e�+ԝM�u�K�q����2�~hf�!���!��� I��Z��p�C��t�e�/4�} o)W��2Xf���^��+�����DJK,�Z�,��f���T�#�ْ+�<�_쌀�ϑ;�w����kA�W��5o*?_���Fc:�ǽc�0��qt��%K�mN� �kV�9�EOh��O��k�G"��r^i�:jrZ�!��\�kJE<�{2V��[��<U+UR�V��`�� |�=V`K"r}\�i͌o~$�6D��tδ�mZyt��$'�g�KY�@�w�Е&����%�,�Uvɦ�{�Ҭ&��*r~+��{��U�eY��51��i �4�+6���^5��㏒����e$�q�X_��ꋷ�56g?��;w ����'ȵ�_`����cM�0H��&Yڗ/�g���&ɕ��s���P�l��8x��A����l7mX Ԩ|*���V/��q�Cqy��g����%�j�%j�I@�6�V��0:/`�66n8k.a�! ��n��I/���>O8����n6�K�"�Z�/�]��y�vI���ĪI��O���ZP��%r&M/�e�\?�:�=M� ��u�G����, #����1�;miD���6�K����N[0���s|�: ���h^�~ߺМ\���fq�WVlq�뺾nՋ��Q��" ��.̑48��w�:�pʀQm�E��a~g99d/�E�EAn��7��H|1j�3<|�w��Z a������ ����������4���Ӛ�;'�J`�ؒ����j���KV��2g��Df,���Ʋ�z�A"|"�M��c,�SrT1��}P���5����E$As��[߹�q"U��a���"x��n�dd5�Ųa��{��q�U��d6�X6~4#��w�.C�{��:��P�C�ޤ����2Y��0\�ϋ�B�>r�}�0� ᔥ���,pi�����/�]d{9{{N�,B�wǕ��#��'S�h��?;wR���7���m�稒$8E!�g�.CQ����Y1�U�Y�o#����ut��� U�"�D�4b'���e���&o�M!�}�-�,y�?|�Y����6KOh7��ʓ��c��ŭg�'�]���;s�ה"��E����&D���ۼ���W��^ݞ�ɡ�-�b�b��]�ʞq��s"�U]�b�<�¡Oa�mu`�G%8��{S�̱�U]��2*�rhՋ�i�N#���q %� ��!���+Δ�-�4u$U���Q� �-��Ln@QD ��S�Jy��¦26���2uoo24S=A����� O5�F�;�FPg����@��`�����(��X?K�8�fk��#�Րщ�v�K-�M�%Nd��.Dz����.m��~�$ae�1b�R��b9�c�Z�eY��~֕=�7x$��8�1o�B#���;�RXKN9U��QvGI����S1��4`q��VƛL�t�u^��9�16%��-~�����u~�Rq�� �p��*�]mI�ؠsx��Yg�r^�Z���0���N����N��X�I�Zł�vN+3����Ih�)�q���U��N�I<{R�J��V.�hV)�>[Y�ӻ��d�挽,�8�:�l���ʝm���ֱX�B״�m-n!_�D���y��u s���W�j�ScC���(�O�k͟���@l�uZ�\l��-[�����WAں4ߜL^��DN7rk ,�"y-�ڗ՜�����y�e())�s�?-iN_֗��V�nvlR!pl)���y�M��^��R���u��yj�����m���S��_�2������M��X����4q��G{���/f���i�ُ��]ID��t�-�����P�Iˆ����ot���I��5�Q��+�gT��X�.-p&��.���/�ys��4��(�b:v�g��$���e�<�ƣM��t�Z���q�D�)��;5���#����/ښڇ�� l�r "(^������t�h��HHz^e���e�}e�Ƶ@�M�s$"�P�.,�}e��>e�;05�,��y�,Žh�5���G�[Cɯ���� ^}����Z-���r擹��[VrO>d�V���&�(iv��R*k��?/X��O�F%j1�`���.y�K�����-qqL�'� ��8����+w�tanC�J��Y�م!��YTd�1VCש��ڕ��?�$_�����
Behavioral task
behavioral1
Sample
MOOFS_EMPIRE_COLORBOT.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
MOOFS_EMPIRE_COLORBOT.exe
Resource
win10v2004-20240709-en
General
-
Target
MOOFS_EMPIRE_COLORBOT.exe
-
Size
7.3MB
-
MD5
ff15fa5525ee90c1272554afe1c24714
-
SHA1
e61ae29cb288eeeccbaac40d7651f382ada8e043
-
SHA256
ad41c436305c4d2551e53c39827d37fdb2e773ecc2724506a67d74bcdbc6e1f0
-
SHA512
b2c15d9c90206e25b535f99062aa8fdaf4432311c9a738611189d41fec302f5fd75ec1e0d368f45ff8dd3f6cace6b86d84bcf43884d4e8f7a8a85acca8b72c9a
-
SSDEEP
196608:tTwnKOh+7xjaAB4nYKtQ0bhyzhul6n45Ih:SnRc7xjaOHK5bhMh06n
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MOOFS_EMPIRE_COLORBOT.exe
Files
-
MOOFS_EMPIRE_COLORBOT.exe.exe windows:6 windows x64 arch:x64
Password: 2024
81a282a7674ad3d2396baf9b6fd4604b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
OutputDebugStringW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CloseClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
BitBlt
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?setf@ios_base@std@@QEAAHHH@Z
shlwapi
PathFindFileNameW
imm32
ImmReleaseContext
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord26
crypt32
PFXImportCertStore
ws2_32
setsockopt
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
localeconv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 722KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 932KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ