Overview

overview

10

Static

static

10

c9daca7de1...3f.exe

windows7-x64

10

c9daca7de1...3f.exe

windows10-2004-x64

10

cleaner.exe

windows7-x64

10

cleaner.exe

windows10-2004-x64

10

node.exe

windows7-x64

10

node.exe

windows10-2004-x64

10

service.js

windows7-x64

1

service.js

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    c9daca7de1b623867aee943a1d508573841f2584ffa91aaaf09de2a883d2733f.exe

  • Size

    6.7MB

  • Sample

    240502-cj4xcsgc32

  • MD5

    7a506a2e92bc66a9f64c2333a815e97a

  • SHA1

    a123f6c070f4258c481cb0b6c2b5d1403463e2fa

  • SHA256

    c9daca7de1b623867aee943a1d508573841f2584ffa91aaaf09de2a883d2733f

  • SHA512

    8bdec3839ca8e0c72dcb76455ad1585264dcef4150d90e0299b477f99590a1b98ac0bd377985ac2e8e2c15f071588ad821650fc200e0f65ec4583f3f82582e30

  • SSDEEP

    98304:W3njVY6OUdcAFccO//cirLLuaj06dT92azIXajHMtHM8gGIOBYADTeLhl6GC1tLt:W3Hvn5irnuaA6GaPj+VgGIOYSTeLXo

Score
10/10
privateloaderloaderpersistenceupx

Malware Config

Targets

    • Target

      c9daca7de1b623867aee943a1d508573841f2584ffa91aaaf09de2a883d2733f.exe

    • Size

      6.7MB

    • MD5

      7a506a2e92bc66a9f64c2333a815e97a

    • SHA1

      a123f6c070f4258c481cb0b6c2b5d1403463e2fa

    • SHA256

      c9daca7de1b623867aee943a1d508573841f2584ffa91aaaf09de2a883d2733f

    • SHA512

      8bdec3839ca8e0c72dcb76455ad1585264dcef4150d90e0299b477f99590a1b98ac0bd377985ac2e8e2c15f071588ad821650fc200e0f65ec4583f3f82582e30

    • SSDEEP

      98304:W3njVY6OUdcAFccO//cirLLuaj06dT92azIXajHMtHM8gGIOBYADTeLhl6GC1tLt:W3Hvn5irnuaA6GaPj+VgGIOYSTeLXo

    Score
    10/10
    privateloaderloaderpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • UPX dump on OEP (original entry point)

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

    • Target

      cleaner.exe

    • Size

      4KB

    • MD5

      e9ded10dff258f6522fe9079ed3319ca

    • SHA1

      b0127ea7675f6359bfa80a7bf6282bd1c989b405

    • SHA256

      ea1d61984ede5908e0840e91a71bb127efd62d836c1f76702b426fd79b57f780

    • SHA512

      d95482d3cf50b37e999e3f91377bd41a215f3f0c55c9f3e47fc9c563b9cd3f5c5ee945878889a8147b9f089005826ce81398172395d0107dc14eb8fefc0d36de

    Score
    10/10
    privateloaderloaderpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • UPX dump on OEP (original entry point)

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral3behavioral4

    • Target

      node.exe

    • Size

      6.6MB

    • MD5

      5f40521d2e1082fe1c734610c4a83911

    • SHA1

      86d54874cc8976cdb75a9dc8dcd817af50837796

    • SHA256

      79ac7ae94231a392d27f303418e305a60c4194dbbe143c5deffc977c7b2e7a78

    • SHA512

      ef2b54b46844cfb13cfdef6271e2a8b4e646d2e31ca55229e5c76ca90c649895533bc8fb83c4d50dd3721abb2a5e4c5ee32df5c4540e1c14498a5e9b550d3189

    • SSDEEP

      196608:QLqzi3tI29TS60FIEPgaJzR1VOoaOVxRtx:QLqzi3XT0uEp/ooaWzx

    Score
    10/10
    privateloaderloaderupx

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • UPX dump on OEP (original entry point)

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral5behavioral6

    • Target

      service.js

    • Size

      186KB

    • MD5

      42fb0fa52c2e0bbbdf379c1aba97d12e

    • SHA1

      164c4639d99a7dcfacf29da930ca4dfef3621a11

    • SHA256

      3db6ffa48cae2dbdc68f9bf5ee75ba5b7abd4f923c5fc6741477916957909071

    • SHA512

      b9e96ba85508bb44f49dbf92185157db149fab2a6245a2d39ce49da5ae14617928f44cf8ee2bcb8c9dd4060082cc4b2b84ea6ff7659ce15caa8d9da02c46c936

    • SSDEEP

      3072:fBBZhuuaOKnzpxfuZlrmpSDjmiwo6DQUH0RUISQ2PgdLJ35kCJQuHoz3jn:5BZhuuaBnzpxf5pSDjf6DhHk2PgdN5Lw

    Score
    1/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks