Colorbot.zip
- SHA256 88fc674ef4f44ef68af61176afff7ddcd5b16f862c2146f411f4903190672ff5
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Colorbot/Colorbot.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Colorbot/Colorbot.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Colorbot.zip
- Size 1.0MB
- Sample261017-tedcaasw7p
- SHA256 88fc674ef4f44ef68af61176afff7ddcd5b16f862c2146f411f4903190672ff5
- MD5 1fcaa8a3f1081d0a01f76c81fadf4ae0
- SHA1 5a466b5262a1771f8b681a6140404a434f14f5ce
- SHA512 c6c663b3f229a8a7e6bd55e8ffa6581a97b94a8de0e514b6123fff37005033176b7c5be34c765774f4d6765c502bfefaf7bb0d4f55f9656acfd6315949bdedb4
- SSDEEP 24576:QzrCNgvrgw+g4/i52LPGYW4w1DbDiEJaZZ19mq:QzrCNgv3ijGYO1fJaZZPN
- TLSH T190253316D9FD0499DC49F6BEFD8CA81B21F89B616C639C41A8CFC90FE1221032ED5670
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Colorbot/Colorbot.exe
File Explorer
-
Colorbot.zip.zip 1.0MB
-
Colorbot/Colorbot.exe.exe 1.6MB
-
Colorbot/offsets.json7KB
-
Colorbot/offsets.version24B
Colorbot/Colorbot.exe
- IMPHASH 61c1ce03bb7eb15794387545e2d86d91
- SHA256 df3a2a37008e56c253586eac7dc65044259f0fdd0af9ced36da935be80cbd7d0
- MD5 71d6bf3458bbc989381cd8dcdb7c7784
- SHA1 99301e656be3059b96db91085cc218ca29693461
- SHA512 d9e421efb8b50c02e5cb2c500986253fc580b90b9585bababcd8d88391da70f3785c97e2c11cb812286094e02ae1b4409ab1648fb01fd9dfd6c67f51effdae18
- SSDEEP 24576:sz2ICAoIgyRflCIgSCGPIoByi/vexYLP6YyeIanh61KKTCxbWytYUjUDZ8bzcn:sz2EpR9bgSCsNNlj6YQanh6fytXkn
- TLSH T1FA85CF05F3E142E9D4265A38C952D70BEB7078881B1086CF73ED5E982F932E45EBB365
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
415888
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\sefer\Desktop\Colorbot\Colorbot.pdb
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
winhttp
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpOpen
WinHttpQueryHeaders
WinHttpReadData
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
HeapReAlloc
GetOEMCP
GetACP
GetEnvironmentVariableW
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GetModuleFileNameW
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CloseHandle
Module32FirstW
ReadProcessMemory
Module32NextW
GetExitCodeProcess
SetThreadPriority
Sleep
GetCurrentThread
IsValidCodePage
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LoadLibraryExW
VirtualProtect
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
HeapFree
HeapAlloc
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
WriteFile
GetStdHandle
TerminateProcess
ExitProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
ReadFile
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
GetProcessHeap
SetStdHandle
CreateFileW
GetStartupInfoW
SetUnhandledExceptionFilter
GetCPInfo
GetStringTypeW
WakeAllConditionVariable
HeapSize
WriteConsoleW
SetEndOfFile
LCMapStringW
GetLocaleInfoEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetCurrentThreadId
LocalFree
FormatMessageA
RtlUnwind
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
SleepConditionVariableSRW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
user32
SetProcessDPIAware
UpdateWindow
SetWindowPos
PostQuitMessage
FindWindowW
SendInput
PostMessageW
GetKeyNameTextA
GetAsyncKeyState
MapVirtualKeyA
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetWindowRect
TranslateMessage
GetCursorPos
DefWindowProcW
DestroyWindow
MessageBoxW
SetWindowLongPtrW
CreateWindowExW
GetSystemMetrics
UnregisterClassW
GetWindowLongPtrW
RegisterClassExW
ShowWindow
IsWindow
DispatchMessageW
PeekMessageW
SetLayeredWindowAttributes
shell32
ShellExecuteW
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
Name
.text
Size
597KB
Virtual Size
596KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=260, version=35222,
count=19, id=259, version=35222,
count=10, id=259, version=35721,
count=17, id=260, version=35721,
count=93, id=261, version=35721,
count=180, id=261, version=35222,
count=21, id=257, version=35222,
count=233, id=1, productName=Unmarked objects,
count=16, id=265, version=36260,
count=1, id=255, version=36260,
count=1, id=258, version=36260,
Colorbot/offsets.json
- SHA256 b5455f6dda9cf7fb1bf42bd946e4685814c41174396828f0917a9815f9c35247
- MD5 8462dee21edf007cf26ede9a649626d9
- SHA1 2d42a2e13fe4f15375bc08173b28aa6c5123c84f
- SHA512 e212ffc25e24d688a801279d1ceee5927a7c25a2846f7731d91adee0632ba8ca498c0740831dade57ceae40f4af508e9e6717a43987732bc326d1c935391136b
- SSDEEP 192:ubY11K8RNvNenCM0SZia72j52v5Ywqwt8/0TkOEdzd:ubYDTXEq2ia72Mv5hqwt8/jOg
- TLSH T18CF17180FFE9BDBA1D5AB375192F75839CBA606241034F99B4ECC70C60D896D3649B0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Colorbot/offsets.version
- SHA256 1d500c5dcf09943125655607331eef40f3e044f88a39b9c8f186b2beb64cb90d
- MD5 98529116a11cd994a73477d5b4c392bf
- SHA1 ed9946e122ad9595299e08407d2b22df3f7719f3
- SHA512 4283b29d71e673e80bad86479c2110a2f8241f8aed09065a3c349b80ae8b72d03f36b2ea9c9c41e42fc6791873afcb0cb7ad3e37b79ee424702ca93b0d35ea38
- MD5 SHA1 SHA512