privateloader

General

Target

604d9839fb6abd7fc87fd9c68910d24dfe1800b1edf5fbf87728936a61a768b2
Size

2.6MB
Sample

231207-3rn4zsgb86
MD5

4aad4b7d1bc6b841c08cc1544e800bbd
SHA1

bf55a61639da88a1be33d2422d85ca6f6759fb07
SHA256

604d9839fb6abd7fc87fd9c68910d24dfe1800b1edf5fbf87728936a61a768b2
SHA512

432106bfb48e6db306b3bdf6011cbfa7e56802015693a378809281d939db263fc27aa53bf451ed2110e0c3ff5a1518514ba80f958ed3bd0e96ece2357f0a412f
SSDEEP

49152:KoWs0/LpPLc0zHxc39bS8Vs7i1hTJIJGeEASRsJJ24vFheMRuKPSr:hMD1gV9bSQWiJ5eE7mJJ24vbeMRD6

Score

10^/10

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32

Targets

- Target
  
  604d9839fb6abd7fc87fd9c68910d24dfe1800b1edf5fbf87728936a61a768b2
- Size
  
  2.6MB
- MD5
  
  4aad4b7d1bc6b841c08cc1544e800bbd
- SHA1
  
  bf55a61639da88a1be33d2422d85ca6f6759fb07
- SHA256
  
  604d9839fb6abd7fc87fd9c68910d24dfe1800b1edf5fbf87728936a61a768b2
- SHA512
  
  432106bfb48e6db306b3bdf6011cbfa7e56802015693a378809281d939db263fc27aa53bf451ed2110e0c3ff5a1518514ba80f958ed3bd0e96ece2357f0a412f
- SSDEEP
  
  49152:KoWs0/LpPLc0zHxc39bS8Vs7i1hTJIJGeEASRsJJ24vFheMRuKPSr:hMD1gV9bSQWiJ5eE7mJJ24vbeMRD6
Score

10^/10

privateloader risepro smokeloader backdoor paypal collection discovery loader persistence phishing spyware stealer trojan
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1