privateloader

General

Target

0702315c2af23584f8ef1febc660651c052eb448819d4c7432e51148ea8db5a5_NeikiAnalytics
Size

405KB
Sample

240521-gbqf8adh8t
MD5

1a58288224c79dc2044ca29e638ef5c1
SHA1

5fd106948f289eff5c93d024af2099ea1be433eb
SHA256

0702315c2af23584f8ef1febc660651c052eb448819d4c7432e51148ea8db5a5
SHA512

f634c69fb0173ba905e234f84963d39c45dc433be2190224da8cb850eeb86b1de7fc128ece5f1f1bec24436a4b0f74bd8021024636767af869b10bd20cb2183c
SSDEEP

12288:6fr32XSfBAlkQZZMx6eIuKRPDEO22Ww0XpQ:6fr32ilYZy6H9Ee2XpQ

Score

10^/10

Malware Config

Targets

- Target
  
  0702315c2af23584f8ef1febc660651c052eb448819d4c7432e51148ea8db5a5_NeikiAnalytics
- Size
  
  405KB
- MD5
  
  1a58288224c79dc2044ca29e638ef5c1
- SHA1
  
  5fd106948f289eff5c93d024af2099ea1be433eb
- SHA256
  
  0702315c2af23584f8ef1febc660651c052eb448819d4c7432e51148ea8db5a5
- SHA512
  
  f634c69fb0173ba905e234f84963d39c45dc433be2190224da8cb850eeb86b1de7fc128ece5f1f1bec24436a4b0f74bd8021024636767af869b10bd20cb2183c
- SSDEEP
  
  12288:6fr32XSfBAlkQZZMx6eIuKRPDEO22Ww0XpQ:6fr32ilYZy6H9Ee2XpQ
Score

10^/10

privateloader xmrig bootkit evasion execution loader miner persistence trojan upx risepro stealer
- Modifies firewall policy service
  evasion
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2