Overview

overview

10

Static

static

3

Setup [VIRUS].zip

windows10-2004-x64

10

setup.exe

windows10-2004-x64

10

Resubmissions

28/11/2023, 00:12

231128-ag7jcsdg94 10

28/11/2023, 00:01

231128-abbjqsdg62 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Setup [VIRUS].zip

  • Size

    3.0MB

  • Sample

    231128-abbjqsdg62

  • MD5

    e39b34ca5705e7f86fca22aa43dfcdf9

  • SHA1

    54224730acfb9892e2f028d4fd3d6481d7f02563

  • SHA256

    11dc9ab5fc6565d6ca32019b8ac3f604b9a6b531dbfe2a6264a159c748a6eb11

  • SHA512

    e2b7a78c10456221f3cf179005eb29edb5e00e7dbf34940e5a77e7e82039e644f6169bb48f8d54acb16750011917c7bc1b60ada4231a937e9d0d1fdcdf505880

  • SSDEEP

    49152:Ma01v1gLpOjIp7QWnPAOTwAQivX1nZ+sHzdpJY9P3c:DE10EjIppuEX1nbRmc

Score
10/10
privateloaderloaderspywarestealer

Malware Config

Targets

    • Target

      Setup [VIRUS].zip

    • Size

      3.0MB

    • MD5

      e39b34ca5705e7f86fca22aa43dfcdf9

    • SHA1

      54224730acfb9892e2f028d4fd3d6481d7f02563

    • SHA256

      11dc9ab5fc6565d6ca32019b8ac3f604b9a6b531dbfe2a6264a159c748a6eb11

    • SHA512

      e2b7a78c10456221f3cf179005eb29edb5e00e7dbf34940e5a77e7e82039e644f6169bb48f8d54acb16750011917c7bc1b60ada4231a937e9d0d1fdcdf505880

    • SSDEEP

      49152:Ma01v1gLpOjIp7QWnPAOTwAQivX1nZ+sHzdpJY9P3c:DE10EjIppuEX1nbRmc

    Score
    10/10
    privateloaderloader

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1

    • Target

      setup.exe

    • Size

      786.0MB

    • MD5

      b48335993e3d89c53c63225647f5dadc

    • SHA1

      ba0e7e046f666c3dc23ce54ad4bba0792fa9d22f

    • SHA256

      01b4f5e579f071227586caf4a23e4cedce851bbad6d75b16e250e8def88f677d

    • SHA512

      cf7775bf7b529f27bb7d8fab21c20d7136d8105f27bf9349cd51eed0594264c53345f7819cfcd90e3659530a6203632d4f337d0fc759058aa6265af74e4c93dd

    • SSDEEP

      49152:IKkl/M0EOFreudY6+idOP3SmT13QhkMrapZKAZc677HB1+vch5:IKa/3EOFreodOPJZORSZKA9XBU

    Score
    10/10
    privateloaderloaderspywarestealer

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral2

MITRE ATT&CK Enterprise v15

Tasks