privateloader | file[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 1.6MB
Sample231206-k3a3dsdb84
SHA256 4aa27ef0b208938bd1d07c7c1dc095d36b1bde24d096f983c4e6107da3060e2e
MD5 14555ac2b19d64ce9f7c843e97c18e69
SHA1 33f7d8f409921785d0697b22ea5d0f934cc00bf5
SHA512 1ecdf0079f98a5315b370aa19edee0c01e7dd4db2532b36838ffe1718ca4e612194335b7f766b83fcb2e16a1fd4a9d1153b993e81fb2141904ca4bfd654fe56b
SSDEEP 49152:qWg8wUmZOzqiavjDUJO/WH89ctcO0ljbbQnIQGotBKqD8TJCHEGU42sn6:ZiUmZOzqiavjDUM/WH89y8bboGO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader risepro

Malware Config

Extracted

Family

risepro

193.233.132.51

Signatures

Privateloader family
privateloader
Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 1.6MB

file.exe

IMPHASH a391c991ba6330d6ddb5beaa15ef064c
SHA256 4aa27ef0b208938bd1d07c7c1dc095d36b1bde24d096f983c4e6107da3060e2e
MD5 14555ac2b19d64ce9f7c843e97c18e69
SHA1 33f7d8f409921785d0697b22ea5d0f934cc00bf5
SHA512 1ecdf0079f98a5315b370aa19edee0c01e7dd4db2532b36838ffe1718ca4e612194335b7f766b83fcb2e16a1fd4a9d1153b993e81fb2141904ca4bfd654fe56b
SSDEEP 49152:qWg8wUmZOzqiavjDUJO/WH89ctcO0ljbbQnIQGotBKqD8TJCHEGU42sn6:ZiUmZOzqiavjDUM/WH89y8bboGO
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1083211

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject LocalAlloc GetCurrentThreadId GetModuleHandleA GetLocaleInfoA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetModuleHandleExA GetTimeZoneInformation GetTickCount64 CopyFileA GetLastError GetFileAttributesA TzSpecificLocalTimeToSystemTime CreateFileA SetEvent TerminateThread LoadLibraryA GetVersionExA DeleteFileA Process32Next CloseHandle GetSystemInfo CreateThread ResetEvent GetWindowsDirectoryA HeapAlloc SetFileAttributesA GetLocalTime GetProcAddress VirtualAllocEx LocalFree IsProcessorFeaturePresent GetFileSize RemoveDirectoryA ReadProcessMemory GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx FreeLibrary WideCharToMultiByte CreateRemoteThread CreateProcessA CreateDirectoryA GetSystemTime GetVolumeInformationA CreateEventA GetPrivateProfileStringA IsWow64Process IsDebuggerPresent VirtualQueryEx GetComputerNameA SetUnhandledExceptionFilter FindNextFileA lstrcpynA SetFilePointer CreateFileW AreFileApisANSI EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile GetTempPathW GetFileAttributesW FormatMessageW GetDiskFreeSpaceA DeleteFileW UnlockFile LockFileEx DeleteCriticalSection GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter GetTickCount FlushFileBuffers WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage CreateMutexA FindClose lstrlenA VirtualFreeEx InitializeCriticalSectionEx GetUserDefaultLocaleName TerminateProcess OutputDebugStringA WriteFile GetCurrentProcess HeapFree FindFirstFileA WriteProcessMemory Process32First GetPrivateProfileSectionNamesA SetStdHandle HeapReAlloc ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess GetFileType GetModuleFileNameA SetFilePointerEx LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlUnwind InitializeSListHead GetStartupInfoW UnhandledExceptionFilter FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW GetModuleHandleW GetFileInformationByHandleEx GetLocaleInfoEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive LCMapStringEx EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW

user32

GetSystemMetrics GetDC GetKeyboardLayoutList EnumDisplayDevicesA CharNextA GetWindowRect wsprintfA GetDesktopWindow ReleaseDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteObject BitBlt

advapi32

SystemFunction036 RegOpenKeyExA RegSetValueExA RegEnumKeyA RegCloseKey GetCurrentHwProfileA RegQueryValueExA CredEnumerateA RegCreateKeyExA CredFree GetUserNameA RegEnumKeyExA

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoInitialize CoUninitialize CoCreateInstance CoInitializeEx

ws2_32

closesocket shutdown getaddrinfo WSAStartup send socket connect recv freeaddrinfo setsockopt WSAGetLastError WSACleanup

crypt32

CryptUnprotectData

shlwapi

PathFindExtensionA

gdiplus

GdipAlloc GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageEncodersSize GdipFree GdipCreateBitmapFromHBITMAP GdipGetImageEncoders

setupapi

SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces

ntdll

RtlUnicodeStringToAnsiString