Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

  • Size

    400KB

  • Sample

    220805-j4p29shaf3

  • MD5

    9519c85c644869f182927d93e8e25a33

  • SHA1

    eadc9026e041f7013056f80e068ecf95940ea060

  • SHA256

    f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

  • SHA512

    dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

Score
10/10
privateloaderloader

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12
Attributes
  • payload_url

    https://vipsofts.xyz/files/mega.bmp

Targets

    • Target

      f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

    • Size

      400KB

    • MD5

      9519c85c644869f182927d93e8e25a33

    • SHA1

      eadc9026e041f7013056f80e068ecf95940ea060

    • SHA256

      f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

    • SHA512

      dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

    Score
    10/10
    privateloaderloader

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks