General
-
Target
file.exe
-
Size
5.9MB
-
Sample
230326-nh9xrsac4t
-
MD5
fee20b7f8b91419f68d100878c5ba5c2
-
SHA1
f03663fc7c8f3b7762d9de05c8a5c8105e4458c8
-
SHA256
93dd2c7ca6db55e72f58d2895ae5ad42d1ded6fe9de032dcf1584ed4f3a7c6e8
-
SHA512
27a83d4d7ef3a1a4b2a85d323d3bf9441f2ecb3f10ed5640fa0aee277b0c44109a7002177ea77538f2234315179f7f55d2fc15dd68fd51523fc31017d62432e6
-
SSDEEP
98304:G5+b9ebrL10pgRf0NJQdRUlK5+bI1LoYuFp9kkDqnNzyqu0LbGEFNzuf2rHaxfNf:GApev6pcsoazI1LolFpKlNzyqu0fjzGV
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
file.exe
-
Size
5.9MB
-
MD5
fee20b7f8b91419f68d100878c5ba5c2
-
SHA1
f03663fc7c8f3b7762d9de05c8a5c8105e4458c8
-
SHA256
93dd2c7ca6db55e72f58d2895ae5ad42d1ded6fe9de032dcf1584ed4f3a7c6e8
-
SHA512
27a83d4d7ef3a1a4b2a85d323d3bf9441f2ecb3f10ed5640fa0aee277b0c44109a7002177ea77538f2234315179f7f55d2fc15dd68fd51523fc31017d62432e6
-
SSDEEP
98304:G5+b9ebrL10pgRf0NJQdRUlK5+bI1LoYuFp9kkDqnNzyqu0LbGEFNzuf2rHaxfNf:GApev6pcsoazI1LolFpKlNzyqu0fjzGV
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-