General
-
Target
f_00626b
-
Size
5.8MB
-
Sample
220726-y9qnbahdb7
-
MD5
f7370171deba5ea5285fe49031690ef8
-
SHA1
d03621cf3cb55cc3918b29b2250dbe5ff505155b
-
SHA256
470f22bc90c7fd2ab337440e9b275fef1ce977a7189524e27c3acf3f105276cf
-
SHA512
50da056c5b9ae0aef50057628d83ea47facc6b53aa05215f8a623734798e1934ad951e1088aae5a752ea83a1b74757475d2a45a738460f63941a4fde450d4170
Behavioral task
behavioral1
Sample
f_00626b.exe
Resource
win10-20220718-en
Malware Config
Extracted
privateloader
http://212.193.30.45/proxies.txt
http://193.233.185.125/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
85.202.169.116
Targets
-
-
Target
f_00626b
-
Size
5.8MB
-
MD5
f7370171deba5ea5285fe49031690ef8
-
SHA1
d03621cf3cb55cc3918b29b2250dbe5ff505155b
-
SHA256
470f22bc90c7fd2ab337440e9b275fef1ce977a7189524e27c3acf3f105276cf
-
SHA512
50da056c5b9ae0aef50057628d83ea47facc6b53aa05215f8a623734798e1934ad951e1088aae5a752ea83a1b74757475d2a45a738460f63941a4fde450d4170
Score10/10-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-