Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b1aa29129dfde05dfdd542ed1bddfb823eb6ffa06456eeb8b9eea30f04bcbb94

  • Size

    3.3MB

  • Sample

    240602-j73grsge84

  • MD5

    c1ab79af8fe4b27608926951fedbd7ec

  • SHA1

    e9b8878de3b2b2c56471aa2fe7f32c26e99fd2fb

  • SHA256

    b1aa29129dfde05dfdd542ed1bddfb823eb6ffa06456eeb8b9eea30f04bcbb94

  • SHA512

    50aa25eedd088f1df725742926e283a11f88172f67333826b662c3d525ce6e09cb7159f71ad5d57ec7ccc00ad3e5ccb92d9e154673ffbd2e4b286fc42d225386

  • SSDEEP

    98304:J0ncMa0aY+/3Jyc2r/wBfCrX0TvTtJOEJawWa:Sc8aYcJT2cNCgLT7OLwD

Score
10/10
privateloaderevasionloader

Malware Config

Targets

    • Target

      b1aa29129dfde05dfdd542ed1bddfb823eb6ffa06456eeb8b9eea30f04bcbb94

    • Size

      3.3MB

    • MD5

      c1ab79af8fe4b27608926951fedbd7ec

    • SHA1

      e9b8878de3b2b2c56471aa2fe7f32c26e99fd2fb

    • SHA256

      b1aa29129dfde05dfdd542ed1bddfb823eb6ffa06456eeb8b9eea30f04bcbb94

    • SHA512

      50aa25eedd088f1df725742926e283a11f88172f67333826b662c3d525ce6e09cb7159f71ad5d57ec7ccc00ad3e5ccb92d9e154673ffbd2e4b286fc42d225386

    • SSDEEP

      98304:J0ncMa0aY+/3Jyc2r/wBfCrX0TvTtJOEJawWa:Sc8aYcJT2cNCgLT7OLwD

    Score
    10/10
    privateloaderevasionloader

    • Modifies firewall policy service

      evasion

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks