MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c986afb6b41d43bbc3d526dad0629c3903aed6f88e0d4a86014748617dfab5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ColibriLoader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c986afb6b41d43bbc3d526dad0629c3903aed6f88e0d4a86014748617dfab5a
SHA3-384 hash: 02cecdc298688b62fe30356ca4736139020e9084e7681958abcb99d306579b929e177260ebb8bef581c5763e055e01e5
SHA1 hash: 397d8c152fbf0b746aeb7e69141c662297aa9379
MD5 hash: 6590c006da1047ab975529d3ed46619a
humanhash: spaghetti-zulu-eighteen-salami
File name:file
Download: download sample
Signature ColibriLoader
Create hunting rule
File size:616'448 bytes
First seen:2022-09-02 06:28:20 UTC
Last seen:2022-09-03 01:21:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6bac1a41c35cf62a504dbecf0412626a (13 x ColibriLoader)
ssdeep 6144:KLuAvRbXvC79gVoA550CbeoLFroWiYfQ82bAGpMTO0I6:KLuAv9vo9gVoA57TLiEhGgO8
TLSH T121D4D415F5E154FED435CEEE08C887F89718B8C1824C71DBA1E6A86A096F00F6F6BD46
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:ColibriLoader exe smartectechnologies-com


Avatar
andretavare5
Sample downloaded from https://smartectechnologies.com/12/TrdngAnr6339.exe

Intelligence

File Origin
# of uploads :
22
# of downloads :
320
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
socelars
Create hunting rule
ID:
1
File name:
https://urloso.com/2cjlt
Verdict:
Malicious activity
Analysis date:
2022-09-02 06:10:10 UTC
Tags:
evasion trojan socelars stealer opendir loader rat redline raccoon recordbreaker
Link:
https://app.any.run/tasks/7f858caf-00aa-4a69-a196-2bbfc5bda164

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/307348/
Detection(s):
SecuriteInfo.com.Variant.Jaik.93549.15642.30991.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/36361/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6311a2afa7450371f69ae40e/reports/6f5407f5-0baf-4355-9d00-35e752b32ac0/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/42ffacf1-bae6-4e8d-8bfb-473016bcbd20
Result
Threat name:
Unknown
Detection:
unknown
Classification:
n/a
Score:
0 / 100
Link:
https://www.joesandbox.com/analysis/1063740
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c986afb6b41d43bbc3d526dad0629c3903aed6f88e0d4a86014748617dfab5a/
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2022-09-02 06:29:08 UTC
File Type:
PE (Exe)
AV detection:
17 of 25 (68.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dsmgv63lihkdxpb5kjw22brjyoidv3lprdqnjkdacr2imf67vnna._file
Result
Malware family:
colibri
Create hunting rule
Score:
  10/10
Tags:
family:colibri botnet:build1 discovery loader miner persistence spyware stealer
Link:
https://tria.ge/reports/220902-g8wz9sbha9/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Detectes Phoenix Miner Payload
Colibri Loader
Malware Config
C2 Extraction:
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Unpacked files
SH256 hash:
1c986afb6b41d43bbc3d526dad0629c3903aed6f88e0d4a86014748617dfab5a
MD5 hash:
6590c006da1047ab975529d3ed46619a
SHA1 hash:
397d8c152fbf0b746aeb7e69141c662297aa9379
Link:
https://www.unpac.me/results/b6d5b3a6-6c18-4ed6-9eed-fe61fdc10bb3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1c986afb6b41d43bbc3d526dad0629c3903aed6f88e0d4a86014748617dfab5a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/307348/
  
URLhaus
https://urlhaus.abuse.ch/url/2286189/

Comments