General
- Target file.exe
- Size 2.0MB
- Sample221212-l58bcaba79
- SHA256 c633d7549fb4a77e02fa1e48f8fb3e3b41d8a998778d2e2c024949673dad0ba5
Score
10/10
Malware Config
Targets
-
- Target file.exe
- Size 2.0MB
- SHA256 c633d7549fb4a77e02fa1e48f8fb3e3b41d8a998778d2e2c024949673dad0ba5
Score10/10PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Loads dropped DLL
Themida packer
Detects Themida, an advanced Windows software protection system.
Checks whether UAC is enabled
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext