privateloader | 296a5df26e552fd7b3ba812c8a9c90af146ade12b32cdd4dc5e35241a545b923

Sharing

Copy URL Twitter E-mail

General

Target
296a5df26e552fd7b3ba812c8a9c90af146ade12b32cdd4dc5e35241a545b923
Size 1.6MB
Sample231213-1ls5msheek
SHA256 296a5df26e552fd7b3ba812c8a9c90af146ade12b32cdd4dc5e35241a545b923
MD5 a106d7e5d8b59c2e613ceba4346cd0da
SHA1 1be88d3bb6d1fded5ede00efd50df9a5098ae90b
SHA512 d922870fac6a2f4adbcb0b3bb01b636819d1dcf1202ecbac7a90faef286b5c76df8efd10d532698d08b9dcc7929da4e10910262b0a851d4f0e6793a85cbb0d25
SSDEEP 49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader risepro

Malware Config

Extracted

Family

risepro

193.233.132.51

Signatures

Privateloader family
privateloader
Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
296a5df26e552fd7b3ba812c8a9c90af146ade12b32cdd4dc5e35241a545b923

File Explorer

296a5df26e552fd7b3ba812c8a9c90af146ade12b32cdd4dc5e35241a545b923

.exe 1.6MB

296a5df26e552fd7b3ba812c8a9c90af146ade12b32cdd4dc5e35241a545b923

IMPHASH a391c991ba6330d6ddb5beaa15ef064c
SHA256 296a5df26e552fd7b3ba812c8a9c90af146ade12b32cdd4dc5e35241a545b923
MD5 a106d7e5d8b59c2e613ceba4346cd0da
SHA1 1be88d3bb6d1fded5ede00efd50df9a5098ae90b
SHA512 d922870fac6a2f4adbcb0b3bb01b636819d1dcf1202ecbac7a90faef286b5c76df8efd10d532698d08b9dcc7929da4e10910262b0a851d4f0e6793a85cbb0d25
SSDEEP 49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1103947

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject LocalAlloc GetCurrentThreadId GetModuleHandleA GetLocaleInfoA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetModuleHandleExA GetTimeZoneInformation GetTickCount64 CopyFileA GetLastError GetFileAttributesA TzSpecificLocalTimeToSystemTime CreateFileA SetEvent TerminateThread LoadLibraryA GetVersionExA DeleteFileA Process32Next CloseHandle GetSystemInfo CreateThread ResetEvent GetWindowsDirectoryA HeapAlloc SetFileAttributesA GetLocalTime GetProcAddress VirtualAllocEx LocalFree IsProcessorFeaturePresent GetFileSize RemoveDirectoryA ReadProcessMemory GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx FreeLibrary WideCharToMultiByte CreateRemoteThread CreateProcessA CreateDirectoryA GetSystemTime GetVolumeInformationA CreateEventA GetPrivateProfileStringA IsWow64Process IsDebuggerPresent VirtualQueryEx GetComputerNameA SetUnhandledExceptionFilter FindNextFileA lstrcpynA SetFilePointer CreateFileW AreFileApisANSI EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile GetTempPathW GetFileAttributesW FormatMessageW GetDiskFreeSpaceA DeleteFileW UnlockFile LockFileEx DeleteCriticalSection GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter GetTickCount FlushFileBuffers WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage CreateMutexA FindClose lstrlenA VirtualFreeEx InitializeCriticalSectionEx GetUserDefaultLocaleName TerminateProcess OutputDebugStringA WriteFile GetCurrentProcess HeapFree FindFirstFileA WriteProcessMemory Process32First GetPrivateProfileSectionNamesA SetStdHandle HeapReAlloc ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess GetFileType GetModuleFileNameA SetFilePointerEx LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlUnwind InitializeSListHead GetStartupInfoW UnhandledExceptionFilter FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW GetModuleHandleW GetFileInformationByHandleEx GetLocaleInfoEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive LCMapStringEx EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW

user32

GetSystemMetrics GetDC GetKeyboardLayoutList EnumDisplayDevicesA CharNextA GetWindowRect wsprintfA GetDesktopWindow ReleaseDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteObject BitBlt

advapi32

SystemFunction036 RegOpenKeyExA RegSetValueExA RegEnumKeyA RegCloseKey GetCurrentHwProfileA RegQueryValueExA CredEnumerateA RegCreateKeyExA CredFree GetUserNameA RegEnumKeyExA

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoInitialize CoUninitialize CoCreateInstance CoInitializeEx

ws2_32

closesocket shutdown getaddrinfo WSAStartup send socket connect recv freeaddrinfo setsockopt WSAGetLastError WSACleanup

crypt32

CryptUnprotectData

shlwapi

PathFindExtensionA

gdiplus

GdipAlloc GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageEncodersSize GdipFree GdipCreateBitmapFromHBITMAP GdipGetImageEncoders

setupapi

SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces

ntdll

RtlUnicodeStringToAnsiString