Behavioral task
behavioral1
Sample
af9556b0b019ae8c9fa2d87471b64c6d96c3d725ab48ec634ba2e0a4f6f7a903.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af9556b0b019ae8c9fa2d87471b64c6d96c3d725ab48ec634ba2e0a4f6f7a903.exe
Resource
win10v2004-20221111-en
General
-
Target
af9556b0b019ae8c9fa2d87471b64c6d96c3d725ab48ec634ba2e0a4f6f7a903
-
Size
1.5MB
-
MD5
f851db8aac31ab23a106496336b8a3a7
-
SHA1
8f8b9d388d0273cbb14e574b84c9714a966bd576
-
SHA256
af9556b0b019ae8c9fa2d87471b64c6d96c3d725ab48ec634ba2e0a4f6f7a903
-
SHA512
e5032f1d8b4e70f06ef93619dba8d97b451dbdec410c21cf1b820b612168008b0d6be9b7538398acd01c3d6b2500644dc859f525618035f6ed000f3d8117e1cb
-
SSDEEP
24576:Bk74Y8deUAsBeZYyYoMGYVl2Jjj/O3O3al5e6Lz4/9j3tC2lyUJaRy8:3Y8dhedMfQGWal5ngFjdC2lcQ8
Malware Config
Extracted
privateloader
http://37.0.10.214/proxies.txt
http://37.0.10.244/server.txt
http://wfsdragon.ru/api/setStats.php
37.0.10.237
Signatures
-
Privateloader family
Files
-
af9556b0b019ae8c9fa2d87471b64c6d96c3d725ab48ec634ba2e0a4f6f7a903.exe windows x86
9589ad8837113b4b31a6a8a07cbda1f9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetPriorityClass
GetCurrentProcess
lstrcatA
GetModuleHandleA
SetCurrentDirectoryA
GetModuleHandleExA
DeleteFileA
lstrcpyA
GetProcAddress
GetLastError
HeapFree
lstrlenA
HeapAlloc
lstrcpynA
GetProcessHeap
WriteConsoleW
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
TerminateProcess
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
EncodePointer
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
LCMapStringW
GetConsoleOutputCP
GetFileSizeEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
CreateFileW
FlushFileBuffers
HeapSize
HeapReAlloc
SetEndOfFile
DecodePointer
Sections
.text Size: 109KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ