General
-
Target
92618bacafd87b6655b729bcc61285150b0e1c5da339162144d652fe3d6be629.zip
-
Size
2.8MB
-
Sample
230321-r3gnhabd42
-
MD5
cddefd5bbf3f17fe0cf7f7f0ac72b7bf
-
SHA1
ea52c9c185cd3ab430f701fdf948b5b5d56f295b
-
SHA256
0b76a628088122ae9d03a0d3d1df056d87d0ee2a178223f257dbcf719ba4f26b
-
SHA512
b9b875284bed7d2cdc2511f7415ccac3e018564017f53828037b075517cea04dd21f44a2daeba70d509ff12ca67b1501df68e49e445e55e34b2d701738bf67dd
-
SSDEEP
49152:W26SmzaVOhu2QAjg35noEhL+Xrs8TBO+T8IZdo/w78GP5Sot6MlxvQjPSdTKsLtd:d6SmzaVOcR6shXg1OsFZZ75SotyLWtLX
Behavioral task
behavioral1
Sample
92618bacafd87b6655b729bcc61285150b0e1c5da339162144d652fe3d6be629.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
92618bacafd87b6655b729bcc61285150b0e1c5da339162144d652fe3d6be629.exe
-
Size
4.3MB
-
MD5
d80448b684ce5ebb82305199177c428c
-
SHA1
b5aad338c6f026442c18b3ea515abcb7bdb2c0e4
-
SHA256
92618bacafd87b6655b729bcc61285150b0e1c5da339162144d652fe3d6be629
-
SHA512
5dd639188abebbcd3b7a1868ee156b1574316ee7d1f51b6cd8767a50415256d224932b54a9b95d263e499c0619f35e65823e98957e7675bb3ab8654e562462f1
-
SSDEEP
49152:tRcTFkJWRR1WFKymfGEbpzGgcroQsgZ7fh7hNwGi8owARjHZn7/goiSGGYswUNM:/IFkJWgUzeepzGgcroxglJmRGGYsw0M
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-