privateloader | file[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 1.6MB
Sample231206-vxlxtaba64
SHA256 b0a099105feec096fa67af661b592ba2d7a24bd7f625178d89ec7594e6496ebb
MD5 139eda91e705b3731f7efe4176578045
SHA1 f8cacc5f746bb3e568670eae7b72471090538f0a
SHA512 2d5ef00f5a5bb4e9c5a174667f772021a6c9b0a35ad5f413c85522207ddefb2d85c4b2bd3de55efc64cfcceb56f56938c5eadf968f348fd85e7789347d7ece98
SSDEEP 49152:qWg8wUmZOzqiavjDUJO/WH89ctcO0ljbbQnIQGotBKqD8TJCHEGU42sn6:ZiUmZOzqiavjDUM/WH89y8bboGO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader risepro

Malware Config

Extracted

Family

risepro

193.233.132.51

Signatures

Privateloader family
privateloader
Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 1.6MB

file.exe

IMPHASH a391c991ba6330d6ddb5beaa15ef064c
SHA256 b0a099105feec096fa67af661b592ba2d7a24bd7f625178d89ec7594e6496ebb
MD5 139eda91e705b3731f7efe4176578045
SHA1 f8cacc5f746bb3e568670eae7b72471090538f0a
SHA512 2d5ef00f5a5bb4e9c5a174667f772021a6c9b0a35ad5f413c85522207ddefb2d85c4b2bd3de55efc64cfcceb56f56938c5eadf968f348fd85e7789347d7ece98
SSDEEP 49152:qWg8wUmZOzqiavjDUJO/WH89ctcO0ljbbQnIQGotBKqD8TJCHEGU42sn6:ZiUmZOzqiavjDUM/WH89y8bboGO
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1083211

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject LocalAlloc GetCurrentThreadId GetModuleHandleA GetLocaleInfoA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetModuleHandleExA GetTimeZoneInformation GetTickCount64 CopyFileA GetLastError GetFileAttributesA TzSpecificLocalTimeToSystemTime CreateFileA SetEvent TerminateThread LoadLibraryA GetVersionExA DeleteFileA Process32Next CloseHandle GetSystemInfo CreateThread ResetEvent GetWindowsDirectoryA HeapAlloc SetFileAttributesA GetLocalTime GetProcAddress VirtualAllocEx LocalFree IsProcessorFeaturePresent GetFileSize RemoveDirectoryA ReadProcessMemory GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx FreeLibrary WideCharToMultiByte CreateRemoteThread CreateProcessA CreateDirectoryA GetSystemTime GetVolumeInformationA CreateEventA GetPrivateProfileStringA IsWow64Process IsDebuggerPresent VirtualQueryEx GetComputerNameA SetUnhandledExceptionFilter FindNextFileA lstrcpynA SetFilePointer CreateFileW AreFileApisANSI EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile GetTempPathW GetFileAttributesW FormatMessageW GetDiskFreeSpaceA DeleteFileW UnlockFile LockFileEx DeleteCriticalSection GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter GetTickCount FlushFileBuffers WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage CreateMutexA FindClose lstrlenA VirtualFreeEx InitializeCriticalSectionEx GetUserDefaultLocaleName TerminateProcess OutputDebugStringA WriteFile GetCurrentProcess HeapFree FindFirstFileA WriteProcessMemory Process32First GetPrivateProfileSectionNamesA SetStdHandle HeapReAlloc ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess GetFileType GetModuleFileNameA SetFilePointerEx LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlUnwind InitializeSListHead GetStartupInfoW UnhandledExceptionFilter FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW GetModuleHandleW GetFileInformationByHandleEx GetLocaleInfoEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive LCMapStringEx EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW

user32

GetSystemMetrics GetDC GetKeyboardLayoutList EnumDisplayDevicesA CharNextA GetWindowRect wsprintfA GetDesktopWindow ReleaseDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteObject BitBlt

advapi32

SystemFunction036 RegOpenKeyExA RegSetValueExA RegEnumKeyA RegCloseKey GetCurrentHwProfileA RegQueryValueExA CredEnumerateA RegCreateKeyExA CredFree GetUserNameA RegEnumKeyExA

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoInitialize CoUninitialize CoCreateInstance CoInitializeEx

ws2_32

closesocket shutdown getaddrinfo WSAStartup send socket connect recv freeaddrinfo setsockopt WSAGetLastError WSACleanup

crypt32

CryptUnprotectData

shlwapi

PathFindExtensionA

gdiplus

GdipAlloc GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageEncodersSize GdipFree GdipCreateBitmapFromHBITMAP GdipGetImageEncoders

setupapi

SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces

ntdll

RtlUnicodeStringToAnsiString