Behavioral task
behavioral1
Sample
c6bdc5a590a5c53b534c9dd5d345cfe4b311fca31bf4ea86a48e3e88042e31a4.exe
Resource
win7-20220812-es
Behavioral task
behavioral2
Sample
c6bdc5a590a5c53b534c9dd5d345cfe4b311fca31bf4ea86a48e3e88042e31a4.exe
Resource
win10v2004-20220812-es
General
-
Target
c6bdc5a590a5c53b534c9dd5d345cfe4b311fca31bf4ea86a48e3e88042e31a4.bin
-
Size
351KB
-
MD5
04f9e4977cb7f90334d5bf0ccb6c80ce
-
SHA1
e1328a2fc2d2d50c33e74ab8e2048dc2afaa0e2a
-
SHA256
c6bdc5a590a5c53b534c9dd5d345cfe4b311fca31bf4ea86a48e3e88042e31a4
-
SHA512
259644c17b4a4e93e2ca743edfd28dc735a07d2c5f4c17e174018b9126c8a6300751b2fb9750f59d0d84d144f09948db6582f70aeae7ff1f8712fc91d178d299
-
SSDEEP
6144:oGeobZKTvXgK0EvJZ9i81SV2K2d6Or989IwfvyvbAxXUt:ozOZIgQJZS5yc
Malware Config
Extracted
privateloader
http://163.123.143.4/proxies.txt
http://107.182.129.251/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
163.123.143.12
Signatures
-
Privateloader family
Files
-
c6bdc5a590a5c53b534c9dd5d345cfe4b311fca31bf4ea86a48e3e88042e31a4.bin.exe windows x86
3c86c2b83b33b86ba24b34af43867478
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
VirtualAlloc
lstrcatA
GetModuleHandleA
SetCurrentDirectoryA
Sleep
LoadLibraryA
DeleteFileA
lstrcpyA
CreateThread
GetProcAddress
GetFileSize
GetConsoleWindow
GetLastError
GetModuleHandleW
HeapFree
lstrlenA
LoadLibraryW
GetProcessHeap
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetStringTypeW
SetStdHandle
GetFileType
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapAlloc
GetTimeZoneInformation
LCMapStringW
CompareStringW
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
EncodePointer
LoadLibraryExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
DecodePointer
user32
ShowWindow
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
Sections
.text Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 211KB - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ