General
-
Target
File.zip
-
Size
5.3MB
-
Sample
221005-psby6aece7
-
MD5
dd32fac759adf13fd7aef101f6882a4d
-
SHA1
8841d4c7c31beaa4d45cf0d1736971a74c6eee77
-
SHA256
e45e8b37813a33e2b60303f740cbc12088ff60d675606db414d6df417fd743d6
-
SHA512
25a9c343a45956e322941e4c769c20a543dccf435720b466ebd09a115eaf57730a0af0b02e4e926ca7cb6578db22f8ec7cb31e3b51691f4610f32e9f8bd987a8
-
SSDEEP
98304:SNoOrhfhzTC8wTVP6FNLGM1bBWa6/q00yQlHBPGa4lk8fXfz8Gbp08bEY809:mjfhn2JPmNLGM1p0fQ7PGa4lr4Gt0lY1
Behavioral task
behavioral1
Sample
Install.exe
Resource
win7-20220812-en
Malware Config
Targets
-
-
Target
Install.exe
-
Size
686.6MB
-
MD5
436c4290282bda086d3a38ae2ea5c2f5
-
SHA1
c69e9b7ba4967be00330053ba6b152f8393da612
-
SHA256
0fd1f535929f90d75a59c57a8b33e4fb40381bb7ee31b3c18c10cb7c8d6599a3
-
SHA512
ca1efea143c0e73b9c50afeaf0826da24373990c93b176f84e2576596b5296a38765db6710becab1c1829a5a1dba84eb34504f79ae0d55964a845e66a0aab15b
-
SSDEEP
98304:ULX0zHX9KZlxm8pNeRNO+eL1nZ779wnqRJh3kMDpzzY8:qXsHX9KmDJeLj9i4nda8
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-