General
-
Target
592412dd24c6b0efa7e2a0b4b6292e83f6d27652a9e4bb39b74e670323e5d735.zip
-
Size
3.3MB
-
Sample
230321-r3cpjsbd35
-
MD5
b912c12e948241743ae7f3fd87959739
-
SHA1
629e2fae8d487a7976a6169e5539bac7f2f08712
-
SHA256
7e57954c3eff6d664449e15c68278bb4acf834ee4efdc76d000f0ed51f0c03dc
-
SHA512
73bbbf80a477aced0c683fc6bea2e8792504e5459d21e1404df152e4eefd85251cbf0721790cefc8197b2d42e2781345a13ef0de1eccee49aa4696f1dab6c682
-
SSDEEP
98304:8x45Qlj5z+Ff5PAU77a4UHMt0V1xcL3w1VvQcFp:n5QTc5jAxc0nvQap
Behavioral task
behavioral1
Sample
592412dd24c6b0efa7e2a0b4b6292e83f6d27652a9e4bb39b74e670323e5d735.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
592412dd24c6b0efa7e2a0b4b6292e83f6d27652a9e4bb39b74e670323e5d735.exe
-
Size
4.3MB
-
MD5
dc420d217ceaa342947187224505a034
-
SHA1
9dc25130ede5f985135bc3129b31802441c9729e
-
SHA256
592412dd24c6b0efa7e2a0b4b6292e83f6d27652a9e4bb39b74e670323e5d735
-
SHA512
d9151dab6e26f09841ce86e1d060ccc4e9dc019d3567195fc0a99ed86c497596179e138e0db3a656dfc18ee024fd4660e8036f44383604111d350af6c883f2ae
-
SSDEEP
98304:/Hrl0QKys7P7CbM5zD6sILTjblMS0uJXAW0uQ9WCJ+SR8hR:/Ljhsi4osI3jhMSNJXA29CJF8hR
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-