General
-
Target
47cf4693b68af0f6e05d4fd9b344390be3906fa4b382cb550585277c79bfaf98
-
Size
7.1MB
-
Sample
240525-m5mkbaeg65
-
MD5
00b9649db9135ed17b99f7bbbef540f6
-
SHA1
261a866ca89342acf1bf204b5a52561a2d0c5e30
-
SHA256
47cf4693b68af0f6e05d4fd9b344390be3906fa4b382cb550585277c79bfaf98
-
SHA512
c4aa291985b4d2d091086b9ba043c044fe0802e624699b91c7fb569c4cc65e83bdb90c44a384bb90eb02d158dd876ae0a5d64e353881589f4a01b0d2d5047644
-
SSDEEP
98304:Pe7lpxlIAxPWsssfwpAufpzM36ggr+enSwKXgaEX37mJ7Xyw36nC:PeYAxEsf07fpzM3O+JwKXFEX3yJ7CwgC
Behavioral task
behavioral1
Sample
47cf4693b68af0f6e05d4fd9b344390be3906fa4b382cb550585277c79bfaf98.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
47cf4693b68af0f6e05d4fd9b344390be3906fa4b382cb550585277c79bfaf98.exe
Resource
win11-20240508-en
Malware Config
Targets
-
-
Target
47cf4693b68af0f6e05d4fd9b344390be3906fa4b382cb550585277c79bfaf98
-
Size
7.1MB
-
MD5
00b9649db9135ed17b99f7bbbef540f6
-
SHA1
261a866ca89342acf1bf204b5a52561a2d0c5e30
-
SHA256
47cf4693b68af0f6e05d4fd9b344390be3906fa4b382cb550585277c79bfaf98
-
SHA512
c4aa291985b4d2d091086b9ba043c044fe0802e624699b91c7fb569c4cc65e83bdb90c44a384bb90eb02d158dd876ae0a5d64e353881589f4a01b0d2d5047644
-
SSDEEP
98304:Pe7lpxlIAxPWsssfwpAufpzM36ggr+enSwKXgaEX37mJ7Xyw36nC:PeYAxEsf07fpzM3O+JwKXFEX3yJ7CwgC
Score10/10-
Modifies firewall policy service
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-