privateloader | eadcf660e731fd3de0a5a8bee2f2337e7d78438f4e9293d2c90d5e63a2d9368e

Resubmissions

26-07-2024 08:19

240726-j7ytkszeqd 3

07-05-2024 20:40

240507-zgaxtseg4v 10

23-04-2024 21:09

240423-zzq2rsca28 7

Sharing

Copy URL

Twitter E-mail

General

Target

eadcf660e731fd3de0a5a8bee2f2337e7d78438f4e9293d2c90d5e63a2d9368e
Size

68.5MB
Sample

240507-zgaxtseg4v
MD5

3fad2c665be40587cc55b6ec71b5e69e
SHA1

ba6555fa115da634feb895315a8a27c4f78af5e2
SHA256

eadcf660e731fd3de0a5a8bee2f2337e7d78438f4e9293d2c90d5e63a2d9368e
SHA512

bf871243dba523ca5f748d92544730dc3b970e352657767239e0999fa99766bb88bc9f41c94e8bdaba29cb80643d59015a24cf75aa4de223c54f45f506a6b4db
SSDEEP

1572864:C/WHHr9Wu3CiHhEP5Ic3H2PP0fT1Ln7d2u0ycVZKDrFqcQOTskU87:C/8L9WqdHoec3H2HyxLnLlcVZKD4oJU4

Score

10^/10

Malware Config

Targets

- Target
  
  eadcf660e731fd3de0a5a8bee2f2337e7d78438f4e9293d2c90d5e63a2d9368e
- Size
  
  68.5MB
- MD5
  
  3fad2c665be40587cc55b6ec71b5e69e
- SHA1
  
  ba6555fa115da634feb895315a8a27c4f78af5e2
- SHA256
  
  eadcf660e731fd3de0a5a8bee2f2337e7d78438f4e9293d2c90d5e63a2d9368e
- SHA512
  
  bf871243dba523ca5f748d92544730dc3b970e352657767239e0999fa99766bb88bc9f41c94e8bdaba29cb80643d59015a24cf75aa4de223c54f45f506a6b4db
- SSDEEP
  
  1572864:C/WHHr9Wu3CiHhEP5Ic3H2PP0fT1Ln7d2u0ycVZKDrFqcQOTskU87:C/8L9WqdHoec3H2HyxLnLlcVZKD4oJU4
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral5 behavioral6
- Target
  
  Installer.exe
- Size
  
  158.3MB
- MD5
  
  ac686947988fb29c074489a28f32fb86
- SHA1
  
  4760635ba437216456a0633b41748a63aafdd748
- SHA256
  
  69f086ecb0e9b764462e3d62268194b2b9abc8e4492b6c5b38472e1b7897436d
- SHA512
  
  b77afc5775edcf3a66d0bc80024530b08c1ccf0adff9d24f66d71eabaedc415d276d6fb95f5c8ac654d3c7d19652b2a12e45f04e4c31c75763c9cb9cff7b15aa
- SSDEEP
  
  1572864:TULGtNWpvig2iH72GUrstdzcuo3tSONV9k9KDipAsKjUcX5j+BJwB/dlktdXQIAI:W12uI+
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral7 behavioral8
- Target
  
  LICENSES.chromium.html
- Size
  
  8.4MB
- MD5
  
  e400cd908b8fb7c13985e2f5cc7a7044
- SHA1
  
  bbafebdf5b067a7d7da130025851eaa52ec3c9d7
- SHA256
  
  ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
- SHA512
  
  e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e
- SSDEEP
  
  24576:/UrV6CI675knWSgRBPyQlrUmf1C6C6y6Z6/678HqBMUpuQ:MsWKA
Score

1^/10
behavioral10 behavioral9
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral11
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  98b4dac376d5980313bc7cddc38e5168
- SHA1
  
  940306c8f1ca9946d987be2bcb586c85b0d61999
- SHA256
  
  5795634e5f03fa1375b8a7e9655966beadbbe8681afd3c6996aa0f47959d053b
- SHA512
  
  234f9311fa92b5d250f970f59d837edd0373dffc8c5b44dc7a96a07b6e1b386264e3c84d7259fed9df1491d17113685c6039695f2edea3c931bc9a9f227c4f7f
- SSDEEP
  
  49152:a8h7ilnY895zc09Myl6QL3n6F+hTf6yfPvJr8PNStFwLluJMWykOFR:0n1H9MDCn6OFMWyBR
Score

1^/10
behavioral12 behavioral13
- Target
  
  libEGL.dll
- Size
  
  469KB
- MD5
  
  352e1ef0483c2492c5f0bf695e2ebfa7
- SHA1
  
  41be96d978e45cd0594538fe1c2faa11d6456b14
- SHA256
  
  436361c2668a445f23c7782539f5b7fd2a33beed438009d26d372e0b639f25fc
- SHA512
  
  03880cddf3810425171d0392c914e3f050c04275ea9b881890dff5c4a35f443765521a5c075d6b0a09a6c467f8b2e050889341d2e13c34908b74072599ba938c
- SSDEEP
  
  6144:VI9l960ewE3X883ZrzMkBmi12EvUGsADsIgHc:VClY0WM8JrzMIKOD2
Score

1^/10
behavioral14 behavioral15
- Target
  
  libGLESv2.dll
- Size
  
  7.1MB
- MD5
  
  6907ce4456aaf2282780b6f560cf7ef4
- SHA1
  
  ce54371fd09c7858ccea9f449cb60fd3f5ff5196
- SHA256
  
  555de6cbde1f9ace738c6e8b7edf35b96fc55045f09c175d6fec4bcfba206af3
- SHA512
  
  0d28296201da2eda73c36f813382255ad8b54757b907693564aa176e420f3a8072078cf31862679ec9a679e378721820ae1fb5b3bb2553d5c0244205199d97ab
- SSDEEP
  
  98304:ut5gLbmQACQYA7g4fdYlDOckpKOgeSXwm:uE/AVuDSox
Score

1^/10
behavioral16 behavioral17
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral18 behavioral19
- Target
  
  vk_swiftshader.dll
- Size
  
  4.9MB
- MD5
  
  f47f162198eb9a87c9cdb957523be637
- SHA1
  
  10634fb95a514b1729a00a03cd7dc88b95d83f9f
- SHA256
  
  3bd00334be2469806d3f286eb4599d897cf0fba9cf3f3c2b65ad2d2041561159
- SHA512
  
  816132e0071ba56a297f7bab51a6a3b58be3a0b51e2f4c425ac5a8ef2adfb650c5886ba80e5690a3c338f4863eabb72bf9194b7003db245fe268c5e6c0792c62
- SSDEEP
  
  49152:56PkZFjKeDTIEvAvlo6coVQxa8sVr0yN1J+MuXy557nDOPNt7wpr30sN+05uQKYh:5NZFjAgpOz2VeCCAkEvkCvGZD9z
Score

1^/10
behavioral20 behavioral21
- Target
  
  vulkan-1.dll
- Size
  
  917KB
- MD5
  
  5e162bcda79c966d63a15e49c8bf8c13
- SHA1
  
  2f2c77e120b66a34648c22fa23d525b1ead0df67
- SHA256
  
  25d6b4ef0a74f1a04476dc2944def16d4ca2b015277add2ebcfbc1c3df13793c
- SHA512
  
  10a89f1618b9aa96fd524f92b29506045cac8f00ee846e950591d59f6fb49a79268044424e2497e3c75815c140a458c9fb27e781a2fe1949f5eed408abe3326d
- SSDEEP
  
  24576:WV9nIy2kwpHHPDnCo3A1XpQ66Z5WoDYsHs6g3P0zAk7IG3:it2zNLnxA1+66Z5WoDYsHs6g3P0zAk7z
Score

1^/10
behavioral22 behavioral23
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral24 behavioral25

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25