Behavioral task
behavioral1
Sample
PL_Client[1].bmp.dll
Resource
win7-20220715-en
General
-
Target
PL_Client[1].bmp.dec
-
Size
2.5MB
-
MD5
6075e8d65f6122fecab4e2681dea5c11
-
SHA1
7c2ec5491bbc87422505a2414868da71e0fc7d63
-
SHA256
fdabcf5136c073927bf32d09f6fae00b74232faa37c4f2853359402a7a2184a4
-
SHA512
aabdf7f9988e9018a35bca29c136daef7da7f773b5165a8e630366f232330c1014096f7a09495931ccfb4cf6abe7854192964dd3d7580df6ae87e94ec907eb2a
-
SSDEEP
49152:aAPS0bI8bND2rTXjM7he371W6hyf16BCnX1kZ+viERVIUP1SHOAhTx3Og:aAPS0ce4rmhwQXf1t116USHpOg
Malware Config
Extracted
privateloader
http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
-
payload_url
http://193.233.185.125/download/NiceProcessX64.bmp
http://193.233.185.125/download/NiceProcessX32.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://mnbuiy.pw/adsli/note8876.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://luminati-china.xyz/aman/casper2.exe
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
https://cdn.discordapp.com/attachments/978284851323088960/991390417943797810/asp_correct.bmp
http://64.227.67.0/searchApp.exe
Signatures
-
Privateloader family
Files
-
PL_Client[1].bmp.dec.dll windows x86
e77165e03926b2e03ca496fd9c5a1da8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetPrivateProfileSectionNamesA
FindNextFileA
lstrlenA
lstrcatA
GetModuleHandleA
SetCurrentDirectoryA
Sleep
GetModuleHandleExA
GetFileAttributesA
GetBinaryTypeA
QueryFullProcessImageNameA
GetSystemDirectoryA
DeleteFileA
GlobalAlloc
lstrcpyA
SetFileAttributesA
VerSetConditionMask
WideCharToMultiByte
VerifyVersionInfoW
GetSystemTimeAsFileTime
GetComputerNameExA
GetPrivateProfileStringA
HeapFree
HeapAlloc
GetProcAddress
lstrcpynA
GetProcessHeap
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
EnterCriticalSection
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
GetFullPathNameA
FindClose
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
SystemTimeToFileTime
FreeLibrary
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
FindFirstFileA
WriteConsoleW
CloseHandle
CreateFileA
GetLastError
CreateFileW
SetFilePointer
WriteFile
SetEndOfFile
ReadFile
SetEnvironmentVariableW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetStartupInfoW
CreateDirectoryW
FindFirstFileExW
FindNextFileW
SetFilePointerEx
GetFileInformationByHandleEx
QueryPerformanceFrequency
LCMapStringEx
InitializeCriticalSectionEx
EncodePointer
DecodePointer
GetCPInfo
GetStringTypeW
SetLastError
GetThreadTimes
GetCurrentThread
InterlockedPushEntrySList
InterlockedFlushSList
RaiseException
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetFileType
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleFileNameW
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
SetStdHandle
GetStdHandle
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
GetExitCodeProcess
CreateProcessW
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
VirtualQuery
user32
CharNextA
advapi32
RegCloseKey
RegGetValueA
LsaFreeMemory
RegCreateKeyExA
RegSetValueExA
OpenProcessToken
RegOpenKeyExA
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
GetTokenInformation
CryptReleaseContext
shell32
SHGetFolderPathA
Sections
.text Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 169KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ