MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f3b262010f9d12dd37b18903be4c3a5de0f20b2e4841efde7d2250bdf660bc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ColibriLoader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f3b262010f9d12dd37b18903be4c3a5de0f20b2e4841efde7d2250bdf660bc5
SHA3-384 hash: 4cdb26fa0a1e94426290b6411599b39707cac616b345eb793aab41c9fe429ebaff90b0d93864803856f1b274e8887d84
SHA1 hash: 2afc08f044a15a8812e8181cbe37cf9a39cc8243
MD5 hash: 1db9ce2cf416557e3c4815b62e43b31d
humanhash: coffee-network-saturn-juliet
File name:file
Download: download sample
Signature ColibriLoader
Create hunting rule
File size:616'448 bytes
First seen:2022-09-01 23:21:29 UTC
Last seen:2022-09-02 03:23:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6bac1a41c35cf62a504dbecf0412626a (13 x ColibriLoader)
ssdeep 6144:vY+BkUWnbcgwe8O8FeCxJedUBe1kTEd9:vDkLnbc3e8O2Bxkkwd9
TLSH T1CBD4C208F911009582BB15F989C7DEF897C56AA4DAF9C71D96FA7C02E2D83C433EE590
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:ColibriLoader exe


Avatar
andretavare5
Sample downloaded from https://smartectechnologies.com/12/TrdngAnr6339.exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
368
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
No threats detected
Analysis date:
2022-09-01 23:23:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f8c8e63b-d7dd-40ab-8e8b-12a3082d91ed

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/307319/
Detection(s):
SecuriteInfo.com.Variant.Jaik.93549.13221.14504.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/36345/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/63113ed7a7450371f699260e/reports/1a14aded-bdda-43d6-90ed-865cf2f15342/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/e111c989-446d-4c98-a38b-c8cdeb696f9e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1063395
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f3b262010f9d12dd37b18903be4c3a5de0f20b2e4841efde7d2250bdf660bc5/
Threat name:
Win32.Trojan.Jaik
Create hunting rule
Status:
Malicious
First seen:
2022-09-01 17:39:50 UTC
File Type:
PE (Exe)
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b45smiaq7his3u33dcidxzgduxpa6ifs4scb57ph2isqxx3gbpcq._file
Result
Malware family:
colibri
Create hunting rule
Score:
  10/10
Tags:
family:colibri botnet:build1 discovery loader miner persistence spyware stealer
Link:
https://tria.ge/reports/220901-3cjkyscfgr/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Detectes Phoenix Miner Payload
Colibri Loader
Malware Config
C2 Extraction:
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Unpacked files
SH256 hash:
0f3b262010f9d12dd37b18903be4c3a5de0f20b2e4841efde7d2250bdf660bc5
MD5 hash:
1db9ce2cf416557e3c4815b62e43b31d
SHA1 hash:
2afc08f044a15a8812e8181cbe37cf9a39cc8243
Link:
https://www.unpac.me/results/decfe0c3-decf-4ded-a91d-fa32352aefe7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0f3b262010f9d12dd37b18903be4c3a5de0f20b2e4841efde7d2250bdf660bc5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2286189/
Cape
Cape
https://www.capesandbox.com/analysis/307319/

Comments