privateloader

Sharing

General

Target
0702315c2af23584f8ef1febc660651c052eb448819d4c7432e51148ea8db5a5
Size 405KB
Sample240520-v21lrsad99
SHA256 0702315c2af23584f8ef1febc660651c052eb448819d4c7432e51148ea8db5a5
MD5 1a58288224c79dc2044ca29e638ef5c1
SHA1 5fd106948f289eff5c93d024af2099ea1be433eb
SHA512 f634c69fb0173ba905e234f84963d39c45dc433be2190224da8cb850eeb86b1de7fc128ece5f1f1bec24436a4b0f74bd8021024636767af869b10bd20cb2183c
SSDEEP 12288:6fr32XSfBAlkQZZMx6eIuKRPDEO22Ww0XpQ:6fr32ilYZy6H9Ee2XpQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  0702315c2af23584f8ef1febc660651c052eb448819d4c7432e51148ea8db5a5
- Size 405KB
- SHA256 0702315c2af23584f8ef1febc660651c052eb448819d4c7432e51148ea8db5a5
- MD5 1a58288224c79dc2044ca29e638ef5c1
- SHA1 5fd106948f289eff5c93d024af2099ea1be433eb
- SHA512 f634c69fb0173ba905e234f84963d39c45dc433be2190224da8cb850eeb86b1de7fc128ece5f1f1bec24436a4b0f74bd8021024636767af869b10bd20cb2183c
- SSDEEP 12288:6fr32XSfBAlkQZZMx6eIuKRPDEO22Ww0XpQ:6fr32ilYZy6H9Ee2XpQ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

privateloader risepro xmrig bootkit discovery evasion execution loader miner persistence ransomware spyware stealer trojan upx
- Modifies firewall policy service
  evasion
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies boot configuration data using bcdedit
  ransomware evasion
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modifies Installed Components in the registry
  persistence
- Sets service image path in registry
  persistence
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops Chrome extension
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2