privateloader | 20d789c0e93769c8bde419a28e938abe[.]exe

General

Target
20d789c0e93769c8bde419a28e938abe.exe
Size 476KB
Sample220905-fa4f1sdfd8
SHA256 b25ae1db93e568ba7a07c876e4f8af316078b05dd67a994ff79fee997a7a46ab
MD5 20d789c0e93769c8bde419a28e938abe
SHA1 7f1899f9282f5b0ebe9cbc4ca334d4624c84f6ee
SHA512 ca2a440e7872497d53e0e6d6eb52eb77bd7d5e4c983a49637ef547f06e792693611eeed7a2441272e4dd8714a870cda84e9d15d842a1867ac63b9faa21e2aa3e
SSDEEP 12288:drkIT/y8T5PVsSn+OcBLHSQJKLwqBjvrEH7JzF:Rkx8T5GS9uHxJ/crEH7JJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader privateloader

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt
http://107.182.129.251/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
163.123.143.12

Attributes

payload_url
https://vipsofts.xyz/files/mega.bmp

Signatures

Privateloader family
privateloader

File Explorer

20d789c0e93769c8bde419a28e938abe.exe

.exe 476KB

20d789c0e93769c8bde419a28e938abe.exe

IMPHASH 9734ba8626408cec04bb8fa7d8bb6e83
SHA256 b25ae1db93e568ba7a07c876e4f8af316078b05dd67a994ff79fee997a7a46ab
MD5 20d789c0e93769c8bde419a28e938abe
SHA1 7f1899f9282f5b0ebe9cbc4ca334d4624c84f6ee
SHA512 ca2a440e7872497d53e0e6d6eb52eb77bd7d5e4c983a49637ef547f06e792693611eeed7a2441272e4dd8714a870cda84e9d15d842a1867ac63b9faa21e2aa3e
SSDEEP 12288:drkIT/y8T5PVsSn+OcBLHSQJKLwqBjvrEH7JzF:Rkx8T5GS9uHxJ/crEH7JJ
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

248308

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateDirectoryA IsWow64Process lstrcatA GetModuleHandleA lstrcpyA WinExec lstrlenA HeapAlloc GetProcAddress lstrcpynA GetProcessHeap WriteConsoleW LocalFree GetWindowsDirectoryA CloseHandle DeleteFileA LoadLibraryA GetFileAttributesA GetLastError CopyFileA Sleep LocalAlloc GetVolumeInformationA GetCurrentProcess HeapFree GetModuleFileNameA SetEndOfFile HeapReAlloc HeapSize ReadConsoleW ReadFile FlushFileBuffers CreateFileW GetStringTypeW SetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile MultiByteToWideChar LCMapStringW MoveFileExW GetFileType GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW DecodePointer

advapi32

CreateServiceA RegCloseKey StartServiceCtrlDispatcherA GetCurrentHwProfileA CloseServiceHandle RegQueryValueExA SetServiceStatus RegisterServiceCtrlHandlerA OpenSCManagerA GetUserNameA StartServiceA RegOpenKeyExA OpenServiceA

shell32

SHGetSpecialFolderPathA SHGetFolderPathA ShellExecuteA

setupapi

SetupDiGetClassDevsA SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInfo

Sharing