privateloader | 032daa24d8d5b50b4988d4deca976e742d8d0a53ea188d9a8a415297a48d0f17

Sharing

Copy URL Twitter E-mail

General

Target
032daa24d8d5b50b4988d4deca976e742d8d0a53ea188d9a8a415297a48d0f17
Size 1.6MB
Sample231214-ma6ppscheq
SHA256 032daa24d8d5b50b4988d4deca976e742d8d0a53ea188d9a8a415297a48d0f17
MD5 b4b321f66d2a57d547a4e77baa1735cf
SHA1 5f4545d43d2c46b92502953000335417be79289e
SHA512 7c3d59de294f050924ab33102858fdebd2f194eccf87ddd7ec2d53ea9e6185bff5e9d2ca598f2a18c35b1c5d42c07dcf0d31d1894e33b2896feb900774bc7d27
SSDEEP 49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader risepro

Malware Config

Extracted

Family

risepro

193.233.132.51

Signatures

Privateloader family
privateloader
Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
032daa24d8d5b50b4988d4deca976e742d8d0a53ea188d9a8a415297a48d0f17

File Explorer

032daa24d8d5b50b4988d4deca976e742d8d0a53ea188d9a8a415297a48d0f17

.exe 1.6MB

032daa24d8d5b50b4988d4deca976e742d8d0a53ea188d9a8a415297a48d0f17

IMPHASH a391c991ba6330d6ddb5beaa15ef064c
SHA256 032daa24d8d5b50b4988d4deca976e742d8d0a53ea188d9a8a415297a48d0f17
MD5 b4b321f66d2a57d547a4e77baa1735cf
SHA1 5f4545d43d2c46b92502953000335417be79289e
SHA512 7c3d59de294f050924ab33102858fdebd2f194eccf87ddd7ec2d53ea9e6185bff5e9d2ca598f2a18c35b1c5d42c07dcf0d31d1894e33b2896feb900774bc7d27
SSDEEP 49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1103947

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject LocalAlloc GetCurrentThreadId GetModuleHandleA GetLocaleInfoA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetModuleHandleExA GetTimeZoneInformation GetTickCount64 CopyFileA GetLastError GetFileAttributesA TzSpecificLocalTimeToSystemTime CreateFileA SetEvent TerminateThread LoadLibraryA GetVersionExA DeleteFileA Process32Next CloseHandle GetSystemInfo CreateThread ResetEvent GetWindowsDirectoryA HeapAlloc SetFileAttributesA GetLocalTime GetProcAddress VirtualAllocEx LocalFree IsProcessorFeaturePresent GetFileSize RemoveDirectoryA ReadProcessMemory GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx FreeLibrary WideCharToMultiByte CreateRemoteThread CreateProcessA CreateDirectoryA GetSystemTime GetVolumeInformationA CreateEventA GetPrivateProfileStringA IsWow64Process IsDebuggerPresent VirtualQueryEx GetComputerNameA SetUnhandledExceptionFilter FindNextFileA lstrcpynA SetFilePointer CreateFileW AreFileApisANSI EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile GetTempPathW GetFileAttributesW FormatMessageW GetDiskFreeSpaceA DeleteFileW UnlockFile LockFileEx DeleteCriticalSection GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter GetTickCount FlushFileBuffers WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage CreateMutexA FindClose lstrlenA VirtualFreeEx InitializeCriticalSectionEx GetUserDefaultLocaleName TerminateProcess OutputDebugStringA WriteFile GetCurrentProcess HeapFree FindFirstFileA WriteProcessMemory Process32First GetPrivateProfileSectionNamesA SetStdHandle HeapReAlloc ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess GetFileType GetModuleFileNameA SetFilePointerEx LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlUnwind InitializeSListHead GetStartupInfoW UnhandledExceptionFilter FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW GetModuleHandleW GetFileInformationByHandleEx GetLocaleInfoEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive LCMapStringEx EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW

user32

GetSystemMetrics GetDC GetKeyboardLayoutList EnumDisplayDevicesA CharNextA GetWindowRect wsprintfA GetDesktopWindow ReleaseDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteObject BitBlt

advapi32

SystemFunction036 RegOpenKeyExA RegSetValueExA RegEnumKeyA RegCloseKey GetCurrentHwProfileA RegQueryValueExA CredEnumerateA RegCreateKeyExA CredFree GetUserNameA RegEnumKeyExA

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoInitialize CoUninitialize CoCreateInstance CoInitializeEx

ws2_32

closesocket shutdown getaddrinfo WSAStartup send socket connect recv freeaddrinfo setsockopt WSAGetLastError WSACleanup

crypt32

CryptUnprotectData

shlwapi

PathFindExtensionA

gdiplus

GdipAlloc GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageEncodersSize GdipFree GdipCreateBitmapFromHBITMAP GdipGetImageEncoders

setupapi

SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces

ntdll

RtlUnicodeStringToAnsiString