Overview

overview

10

Static

static

8

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    3.9MB

  • Sample

    221201-m5qa7sfa7y

  • MD5

    59e9774b9637c82ae48e2dd21f07368e

  • SHA1

    91836366eef9c11c4509b73108f7b2b43f04c702

  • SHA256

    3b1de56ce6cc0e9a28a356fbf75a71e64c4052bd04019ff9076d0e472a3d282f

  • SHA512

    d899c2aba3d529be043abec65d5ad74add6b3784f7fc1ce5e73d567b8166951902fc64131f6de7191d8cebbed5d5774a3e97776726b8bee8948c8c0a465f38af

  • SSDEEP

    98304:jZ3+9AgufoyoC8sLYvDbUngMq/xhDNlYy80NIJmdfhT+SoS:M9AXoyd87vDbUgM+pNUm5h5

Score
10/10
privateloaderdiscoveryloaderspywarestealervmprotect

Malware Config

Targets

    • Target

      file.exe

    • Size

      3.9MB

    • MD5

      59e9774b9637c82ae48e2dd21f07368e

    • SHA1

      91836366eef9c11c4509b73108f7b2b43f04c702

    • SHA256

      3b1de56ce6cc0e9a28a356fbf75a71e64c4052bd04019ff9076d0e472a3d282f

    • SHA512

      d899c2aba3d529be043abec65d5ad74add6b3784f7fc1ce5e73d567b8166951902fc64131f6de7191d8cebbed5d5774a3e97776726b8bee8948c8c0a465f38af

    • SSDEEP

      98304:jZ3+9AgufoyoC8sLYvDbUngMq/xhDNlYy80NIJmdfhT+SoS:M9AXoyd87vDbUgM+pNUm5h5

    Score
    10/10
    privateloaderdiscoveryloaderspywarestealervmprotect

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks