General
-
Target
File_pass1234.7z.zip
-
Size
4.5MB
-
Sample
230525-p8epzsac39
-
MD5
9aa7f30c03125753000d7615d142211b
-
SHA1
6c16b5c84e37e7b862d1496bc71904cddd4718c4
-
SHA256
c2d6bbfa360de2737edaf24386bd732a32176849c24de7a967e55bdc30e06491
-
SHA512
ddccf38dec035741d83d73539952e2a8651bbb0ba0d3fdb1e89d30bf28432841a80dff75c0a57a0f763777ac58caa9effdd7a3036bc5b2e405e64bd3c75ba753
-
SSDEEP
98304:Lpr7/3QBkODrWQ5BodOAMQMxLKaGCvcUed4w74s8fGrIwc:FrAkY69akPC1ed1Es85wc
Static task
static1
Behavioral task
behavioral1
Sample
File_pass1234.7z
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
File_pass1234.7z
-
Size
4.5MB
-
MD5
e8e6cefe6cfff9d51b0df39fccf9403d
-
SHA1
2ce448433f94f00c7a50539e871a207af7d5fa19
-
SHA256
53b3d8422628b4820e0b49da4af8d7a0d44d3f5284c2fbcc01c5309cb51d4d2a
-
SHA512
cfd47ddcbe84e5a8a012dbfbf26d6d5bbca43d1e4d843d647c7a8d580c3eed087dcd6b4df8b821f46c81c0e9a450406fca36956f47878a098b48de6f9b099c57
-
SSDEEP
98304:NLl0uYbdyUJ4X2X6O99Ts4N24fET/71p3YOaXGea:NLlyb5J4X26qzN2gEDYQ9
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Registers COM server for autorun
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-