privateloader | 39f1f2f936ffef4402319b98967e86d18937118452542f4bf04138461e3410a9

Sharing

Copy URL Twitter E-mail

General

Target
39f1f2f936ffef4402319b98967e86d18937118452542f4bf04138461e3410a9
Size 1.6MB
Sample231214-l4f6gaece2
SHA256 39f1f2f936ffef4402319b98967e86d18937118452542f4bf04138461e3410a9
MD5 6ca87f61ed7e98de23a743be35293360
SHA1 b289350faf67f249cd426dbaca755b6414493e28
SHA512 f82eb3e5a81a4732a0e9f23146cc35577a54869dec1051f4fc8727c6b6c947c9d1d330bddfd456e3f327d6140959f5a5ea8d502c0dc2f028ef932da38989f334
SSDEEP 49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader risepro

Malware Config

Extracted

Family

risepro

193.233.132.51

Signatures

Privateloader family
privateloader
Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39f1f2f936ffef4402319b98967e86d18937118452542f4bf04138461e3410a9

File Explorer

39f1f2f936ffef4402319b98967e86d18937118452542f4bf04138461e3410a9

.exe 1.6MB

39f1f2f936ffef4402319b98967e86d18937118452542f4bf04138461e3410a9

IMPHASH a391c991ba6330d6ddb5beaa15ef064c
SHA256 39f1f2f936ffef4402319b98967e86d18937118452542f4bf04138461e3410a9
MD5 6ca87f61ed7e98de23a743be35293360
SHA1 b289350faf67f249cd426dbaca755b6414493e28
SHA512 f82eb3e5a81a4732a0e9f23146cc35577a54869dec1051f4fc8727c6b6c947c9d1d330bddfd456e3f327d6140959f5a5ea8d502c0dc2f028ef932da38989f334
SSDEEP 49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1103947

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject LocalAlloc GetCurrentThreadId GetModuleHandleA GetLocaleInfoA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetModuleHandleExA GetTimeZoneInformation GetTickCount64 CopyFileA GetLastError GetFileAttributesA TzSpecificLocalTimeToSystemTime CreateFileA SetEvent TerminateThread LoadLibraryA GetVersionExA DeleteFileA Process32Next CloseHandle GetSystemInfo CreateThread ResetEvent GetWindowsDirectoryA HeapAlloc SetFileAttributesA GetLocalTime GetProcAddress VirtualAllocEx LocalFree IsProcessorFeaturePresent GetFileSize RemoveDirectoryA ReadProcessMemory GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx FreeLibrary WideCharToMultiByte CreateRemoteThread CreateProcessA CreateDirectoryA GetSystemTime GetVolumeInformationA CreateEventA GetPrivateProfileStringA IsWow64Process IsDebuggerPresent VirtualQueryEx GetComputerNameA SetUnhandledExceptionFilter FindNextFileA lstrcpynA SetFilePointer CreateFileW AreFileApisANSI EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile GetTempPathW GetFileAttributesW FormatMessageW GetDiskFreeSpaceA DeleteFileW UnlockFile LockFileEx DeleteCriticalSection GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter GetTickCount FlushFileBuffers WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage CreateMutexA FindClose lstrlenA VirtualFreeEx InitializeCriticalSectionEx GetUserDefaultLocaleName TerminateProcess OutputDebugStringA WriteFile GetCurrentProcess HeapFree FindFirstFileA WriteProcessMemory Process32First GetPrivateProfileSectionNamesA SetStdHandle HeapReAlloc ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess GetFileType GetModuleFileNameA SetFilePointerEx LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlUnwind InitializeSListHead GetStartupInfoW UnhandledExceptionFilter FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW GetModuleHandleW GetFileInformationByHandleEx GetLocaleInfoEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive LCMapStringEx EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW

user32

GetSystemMetrics GetDC GetKeyboardLayoutList EnumDisplayDevicesA CharNextA GetWindowRect wsprintfA GetDesktopWindow ReleaseDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteObject BitBlt

advapi32

SystemFunction036 RegOpenKeyExA RegSetValueExA RegEnumKeyA RegCloseKey GetCurrentHwProfileA RegQueryValueExA CredEnumerateA RegCreateKeyExA CredFree GetUserNameA RegEnumKeyExA

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoInitialize CoUninitialize CoCreateInstance CoInitializeEx

ws2_32

closesocket shutdown getaddrinfo WSAStartup send socket connect recv freeaddrinfo setsockopt WSAGetLastError WSACleanup

crypt32

CryptUnprotectData

shlwapi

PathFindExtensionA

gdiplus

GdipAlloc GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageEncodersSize GdipFree GdipCreateBitmapFromHBITMAP GdipGetImageEncoders

setupapi

SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces

ntdll

RtlUnicodeStringToAnsiString