privateloader | e3d958c0be09c74f6ae0a947388ad2a52be5d149fa682badcbb24338fb0edc38

Sharing

Copy URL Twitter E-mail

General

Target
Bitwarden-Portable-2024.4.1.exe
Size 210.0MB
Sample240509-k5e45aab91
SHA256 e3d958c0be09c74f6ae0a947388ad2a52be5d149fa682badcbb24338fb0edc38
MD5 86b77d048515b0e9410f13292908c14c
SHA1 b5bc7c10815b0e12871dbce3dc34ca7164dcc487
SHA512 39aca585f15d1a0fd189356faeaa3c1c567503f1c8bb51b2b1c6f8e17c4226f21b3ac548114ff30019d4997f58187adbfd255a8e7b36560cab6b5f23ad1da837
SSDEEP 3145728:+4fjgXlYBqNJonfqI9fD4/00E55Fwe7ykojzP1kcFDeOMFcU4TB6PcBQHHfSj2zq:Y+osfn9KEtbkz97RdOlcBQH53Gz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader

Malware Config

Targets

- Target
  Bitwarden-Portable-2024.4.1.exe
- Size 210.0MB
- SHA256 e3d958c0be09c74f6ae0a947388ad2a52be5d149fa682badcbb24338fb0edc38
- MD5 86b77d048515b0e9410f13292908c14c
- SHA1 b5bc7c10815b0e12871dbce3dc34ca7164dcc487
- SHA512 39aca585f15d1a0fd189356faeaa3c1c567503f1c8bb51b2b1c6f8e17c4226f21b3ac548114ff30019d4997f58187adbfd255a8e7b36560cab6b5f23ad1da837
- SSDEEP 3145728:+4fjgXlYBqNJonfqI9fD4/00E55Fwe7ykojzP1kcFDeOMFcU4TB6PcBQHHfSj2zq:Y+osfn9KEtbkz97RdOlcBQH53Gz
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app-32.7z
- Size 63.4MB
- SHA256 a9f4f1f626a680e2ba48bc687784c07468ccb401fd44e913151ce950b8299944
- MD5 fae942a0e80161252600dcf814ecf104
- SHA1 8dcaed1a50446b0dc6344da0ebfcecfefdbd0f9e
- SHA512 60e781958bdbd74ba7afb2633b51b597446533867497625686b51a8f68a232775f93cd526949043c5ac1458849087fb5538837e6ac6ff13c14bd3dd13d512d16
- SSDEEP 1572864:QejOYfRPhvA6BqNPcBiXHo2fpUfjt9c4HWPb79Emj:Q4TB6PcBQHHfSj2z7Ga
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  chrome_100_percent.pak
- Size 163KB
- SHA256 b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
- MD5 4fc6564b727baa5fecf6bf3f6116cc64
- SHA1 6ced7b16dc1abe862820dfe25f4fe7ead1d3f518
- SHA512 fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2
- SSDEEP 3072:IOzwJCGIekwdLpsXYFAXg6IL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:IOzw1Iekam5QpK18Gb0OV8ld0GecQ3Ey
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  chrome_200_percent.pak
- Size 222KB
- SHA256 fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
- MD5 47668ac5038e68a565e0a9243df3c9e5
- SHA1 38408f73501162d96757a72c63e41e78541c8e8e
- SHA512 5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89
- SSDEEP 6144:QsDQYaSN6svydHLhQegx5GMRejnbdZnVE6YoppO4:QBfSN6svydrx6edhVELoXO4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  icudtl.dat
- Size 10.2MB
- SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
- MD5 e0f1ad85c0933ecce2e003a2c59ae726
- SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
- SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
- SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16
- Target
  locales/af.pak
- Size 464KB
- SHA256 57670eae6d1871e648ad6148125ee82d08575bec5b323459fc14c3831570774a
- MD5 862a2262d0e36414abbae1d9df0c7335
- SHA1 605438a96645b9771a6550a649cddbb216a3a5b1
- SHA512 a789a4cad72106a5c64d27709b129c4ae6284076f147b7c3fcb808b557a3468b4efe3ede28033f981335d5eab986532c0497ddd6ed24b76189fe49366692ee73
- SSDEEP 12288:KYHoLheVm/Wnzo+E+VOSMKlNu+d2ZH2Jynua2VIzfXo0vIFNgRU2Sw+2Ss37xzOZ:LoL0Vm/Wnzob+wSMag+d2ZH2Jynua2V5
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17 behavioral18
- Target
  locales/am.pak
- Size 756KB
- SHA256 b05dcb8136751aee5eced680a5bad935e386bfce657dd283d3ec00ee722fd740
- MD5 4eaa15771058480f5c574730c6bf4090
- SHA1 2b0322aae5a0927935062ea89bd8bd129fa77961
- SHA512 b67e7dd24eadc91d4cd920f8864cfb23a9c67b2cecd54ec97e01705636604ce504dc417d6af1c53f374b58eddf71a12bb82248bd8fd68307161d4833342681a9
- SSDEEP 12288:sjsuGn8MVs2TZIuHzLzxBT2qE36jpECuzA+5P9LlVrClOwPQVx30jH8+F:HnG2TZVLzxwqEqjpECuzA+5P9LlVrClj
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19 behavioral20
- Target
  locales/ar.pak
- Size 829KB
- SHA256 ea49bc2ceb6b185030eaa0ee0155feca90e632390417299113b02fbe365ff731
- MD5 2b2dfafb0d258c1d2b58e51ae1ee9ab5
- SHA1 2a538491ff4023d29bdf2a053447c6016138d9f2
- SHA512 6b629ed83edfea1b1ff3c379009332e413c420de651a24160fae859e1e0948fbebab99c9da714df6dfad3b9e472dece7bee95815ceca428183f4ac0bd6d42ff3
- SSDEEP 12288:whjQkIYBukM/T/RJGX4Yxwv4UPCNakEz5cN01++QIYkpT:gjfGv9T5b++
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral21 behavioral22
- Target
  locales/bg.pak
- Size 861KB
- SHA256 50e4f6b9c387adf4baba3377c61d99326cc3987928d8d60b88d1ac29352820ea
- MD5 0e8005b17ac49f50fb60f116f822840d
- SHA1 f2486da277de22e5741356f8e73e60b7a7492510
- SHA512 5df18bbeabd56e70d4c5a80dee5b7ce48259000665941634937e556e3b3a1c6403aa45c410f6f755607549c9dd35d722987b447c50efca51228ffeca4628756d
- SSDEEP 24576:9MCo3qBsklYOdAs1axUYVbOAHi373Z5+3aAK5kVDV5uRumpod2JK5ITOuORx6QKq:9MCo3qBsklY/UYVbOAHi373Z83a1kVDj
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral23 behavioral24
- Target
  locales/bn.pak
- Size 1.1MB
- SHA256 e6adcfb4f3b3bccd4a27edadc168b503c36551cd6b27fb24043efeb21f691ce5
- MD5 c8173f0cc63ca9e02c07abec94892b53
- SHA1 2688b199cc40bb2082247fa451eac1304608e48b
- SHA512 3d2317430722dc15c5d938fa55235af1caa03dcff7a574b44d37d89e7cf2c94dd2e84518b3eeca4a5a8dbec1b99d94aed97429aaf55c63998002d50ce9cb5019
- SSDEEP 3072:HPvKTlIymMTAKhwg8KgMokBw20kzhY0/ukfe0/Q8hhar6j7dkjBbJrlD+B5rwDlo:HPvtMTAKhwlFpKAShhG6j7wBb85mlo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral25 behavioral26
- Target
  locales/ca.pak
- Size 524KB
- SHA256 4ecfa3785ab52564e0bd7dda04d59a30163561588a04f3bd1b1b71de051d2c53
- MD5 d193a3ac614f64f4754c9df5cf00e880
- SHA1 0da0f7c1a4048074f6fe9d70704aa93ff75e42f9
- SHA512 e85d18951f9a1a86514d577f9b19a4b3727523c15b4ccdd17217f6fdf69a0e774a36874108a05de1be3dcee1720b0cb19eced2d3283f57f41f5f9c5e233e1c68
- SSDEEP 12288:BLUzxDV3sCB/7kREeopxA3n5PqF4N3Mw2juwHzejm0t3lvq8+x9sfR+IsjcmlLER:2zxDVJwY6vR6QZIMN7vsyL5fdjiu
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral27 behavioral28
- Target
  locales/cs.pak
- Size 539KB
- SHA256 1c9448ea3aefce1a7e1491e73af91af772d8b22d538676a2beab690558e668fa
- MD5 70f320d38d249b48091786bd81343afc
- SHA1 367decdcdad33369250af741b45bdc2ca3b41ab3
- SHA512 02b08ed9261fd021e367995551defaf4b4f54c357409a362f4d2470423644913375cac444f62153ec2963a84880a30a36f827dbfacdd76a6222838c276cf5082
- SSDEEP 6144:Lg4k2oNIYl8pvlntLO2A8YfZA2WBe5rK8VuvNO4w3SBZmPyO8QP:Lposty2A82IBe5rK8VuvNO93SrmPP
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral29 behavioral30
- Target
  locales/da.pak
- Size 487KB
- SHA256 438d2b1fd396c2108ca3902f69eeb372219edd5d95fe70970d8ee9e64556c9a4
- MD5 0e4207e2cf5741a8968617df9174a681
- SHA1 bf9b7558141ad30bbc921992e48d48cd6d6ab475
- SHA512 4ed8368013912c408f7e5f7b4f6f1748834e5506307b92f4b669c557efd27363a55b4e2918eb7707e798878c9492b765f24ab9c90e843f54e8641c4646bc72da
- SSDEEP 6144:ZB7xSTKzVhsN5cvfAe914eA4owlTamJw/zobqU9aFut5HPrmc+zd4bTGqewc:ZeTvyAN4aHK5vrnTpM
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32