Overview

overview

10

Static

static

7

93112B749D...B6.exe

windows7-x64

10

93112B749D...B6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    93112B749D371AD66F0F856A1C0C93D14F67960C644B6.exe

  • Size

    4.9MB

  • Sample

    230402-gdfd2agc2x

  • MD5

    f68190d02dd017828c9e457b80a369a9

  • SHA1

    73c454855ad2613b223f7793397cff5b636e3511

  • SHA256

    93112b749d371ad66f0f856a1c0c93d14f67960c644b6634a5d78dc33d0d8e0e

  • SHA512

    12318d2e75e55fc446ec5a2fd4ffa1076c281b1ac5ad1a2dc7b9e5f1eac96ea2af2cccf742dbb2a549e14f02f82d0729ea554440d5972e0db95ddd475a5a8a65

  • SSDEEP

    98304:HE1/qHZLs2db/0lTp94U7mZCvSZVdBLvuUKGzRVddpyetVjqKvuEPi4Fs:HE1/qHtrLypiU7mZCvSXWoVtRtK

Score
10/10
privateloaderloaderspywarestealervmprotect

Malware Config

Targets

    • Target

      93112B749D371AD66F0F856A1C0C93D14F67960C644B6.exe

    • Size

      4.9MB

    • MD5

      f68190d02dd017828c9e457b80a369a9

    • SHA1

      73c454855ad2613b223f7793397cff5b636e3511

    • SHA256

      93112b749d371ad66f0f856a1c0c93d14f67960c644b6634a5d78dc33d0d8e0e

    • SHA512

      12318d2e75e55fc446ec5a2fd4ffa1076c281b1ac5ad1a2dc7b9e5f1eac96ea2af2cccf742dbb2a549e14f02f82d0729ea554440d5972e0db95ddd475a5a8a65

    • SSDEEP

      98304:HE1/qHZLs2db/0lTp94U7mZCvSZVdBLvuUKGzRVddpyetVjqKvuEPi4Fs:HE1/qHtrLypiU7mZCvSXWoVtRtK

    Score
    10/10
    privateloaderloadervmprotectspywarestealer

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks