General
-
Target
Install.7z
-
Size
5MB
-
Sample
230201-ywfaesbg66
-
MD5
9ef4a2f3dab1ca8a83f6ec9e8c2e4ed5
-
SHA1
47848e9dbeae8933f9d92840553be133e7ca1a76
-
SHA256
26b90207a3f4acac8a5b17412c40ad4af52c2c04eeded067fe4caa874290e71d
-
SHA512
5f287b1f31f9f68f1c2c7e7e3661c4c2e217857fe605e2552b599a25cf3790f836d33312b317a57eaaf5ede19578df8c45277ef06e0c808af6b69fd8f329efa5
-
SSDEEP
98304:Nnn4kXPHl8t7lfbQMrzXrs1ezAtp+5NsqC0GdgChiI:Nn4IPHlOlDQMrzbse0tg5NK0grX
Malware Config
Targets
-
-
Target
Install_1.exe
-
Size
132MB
-
MD5
cdf1214016bc5a7bf6d095d749203870
-
SHA1
d5c52e904ee49618b71623974104928ecb54fd2a
-
SHA256
5705493c9c14b78f5e6ab80bd1e9ccb0e64896a9040676794fa5a19c63e52533
-
SHA512
c4d1e513e394dff89581d775708b82df2abc71c840ac6fc7f0756dc9d69351a72a70c8c0d302a913a2f04e76bd93e68527fab2f74f3695d72ce4d0b5d17a678c
-
SSDEEP
196608:wA9NyhYpien+H1uZ1r+LyVHE//wpiP/U0:wA9NyhRen+H1uTWIp90
Score10/10-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation