privateloader

General

Target

Appgate.rar
Size

18.2MB
Sample

240619-1vadwstcre
MD5

d7e553cb3b702ed6208cf0b30fee257e
SHA1

b2f5b44b6b52d430abac058b836d25a27c70bb1d
SHA256

8d37fdd34765e995a623e0cc32c8670ec4888a531c0f2363fd8a09078902e7f7
SHA512

ba07e56c6307d65a5030c939c8e62c20247b6d6114f041fdc173b679ccf79d819f7a957398eeef9be0c36988052c1951fc9687a01931d67947693ab7545342df
SSDEEP

393216:WX5Sf38EejtVcR+O4hJBdGG4cOaTw/Sja3XchavkTi0Yh2kE4OH:w5Sf38VtEuhTdBOGRjoXchaMTB/H

Score

10^/10

Malware Config

Extracted

Family

stealc

rc4.plain

Extracted

Family

vidar

C2

https://t.me/memve4erin

https://steamcommunity.com/profiles/76561199699680841

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0

Targets

- Target
  
  amdhip64.dll
- Size
  
  10.1MB
- MD5
  
  da6bba744ffe35bd63e61ef2824ff15d
- SHA1
  
  54f12b2bc458c72e071cdff727c4a2f7a33d0ab5
- SHA256
  
  66d5725519eec9f0c16696c9bcf32ba3442551f36ec4bdb17e12f6e0d24027c7
- SHA512
  
  74ba3f3c817fb0519b42e7f68ac8d87692e461c1a8529ae86051bbf891350bab05023046da6b69648681e26656624c97bac9707938511190e1dab8afd45ded4a
- SSDEEP
  
  98304:FqFhXse/Y7jUHRRFcwETkorMg/696ffjZMXNDVjCXN2MX2:AXs37juRTcwETkGMUjZMXNDVjCXN2V
Score

1^/10
behavioral1
- Target
  
  concrt140.dll
- Size
  
  309KB
- MD5
  
  31f210ed5c6f2d8faa1d896cda18584b
- SHA1
  
  5444d919f5014fb6bf58cefc6f01088c32a24a00
- SHA256
  
  5393f592cded7bd8ae07b2afc3efdcc4a0b05f7e8e74380a267398266fc02d41
- SHA512
  
  d39aa7acfd982759825b537a9ca5b04e6cdd9c0a28089e0f666ae4b75e84e2e2e58180103da38bea79efe3252cb9f1932efa69b64461cb76173645e8b6ddf3f6
- SSDEEP
  
  6144:Ylm+bq4hSdOec4xWMXdtvo4KbrniIzb7wQjnWzgCE33g:pmP/eJXzvSCzW3g
Score

1^/10
behavioral2
- Target
  
  res_mods/1.23.0.0/scripts/client/gui/mods/mod_a.pyc
- Size
  
  114KB
- MD5
  
  a2f3ded45da8870e93e5d2186dab27e8
- SHA1
  
  3f8e0cddecc3827b33ec02cd78d192c18f1ddf82
- SHA256
  
  fc19237a4e9ae65829dbde384ce0de2c78b22d9577384dded9d4cde569a12742
- SHA512
  
  438621491061c7f14f59c48d0d2fdd637a17c058df13417e21d660d81632dbb826a6144032f6f9192ab9bb0afb46b8f6cf3982879dc9942261c2538dbd17187c
- SSDEEP
  
  3072:k6BVH7SBjeSCbupKVfG2yQJ23J+Svsy9k/TukuPMh:zrbKeWmDyQ+13kOPMh
Score

3^/10
behavioral3
- Target
  
  setup.exe
- Size
  
  783.0MB
- MD5
  
  c230ac906ce7c05b1a9a59a2aca3a17c
- SHA1
  
  63d24c78b2267074354c5b53f2ddf0805c225258
- SHA256
  
  40c38f9e27248e40f7cc31dab2c57fafff7209b16c63d164426043f7ec44e82f
- SHA512
  
  b2d724a06f801cb5263a5a363836a7ea24772f6f51748b721ec207d12c910d14672e871df664e27cb0547baec7c48d39f0e27b7149f7b5e46987e47715151031
- SSDEEP
  
  196608:KIUHYoEdbBe7Vn07IL0mcX95Abtqm9ml38A5ifzav2gjVmwL2YL4OcaqJ+X:KIkSBpIwdX9mlml3xogYw/CJ+
Score

10^/10

privateloader risepro stealc vidar evasion loader spyware stealer themida
- Detect Vidar Stealer
  stealer
- Modifies firewall policy service
  evasion
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Downloads MZ/PE file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral4
- Target
  
  vvmsvcp140.dll
- Size
  
  576KB
- MD5
  
  a11a1d761d757d367146f0f772632d8c
- SHA1
  
  9fd3eee4c4111dc386510a930192d56a2e938dfe
- SHA256
  
  2cc02c5e6654aa9175d5963f811cac222f4a2604dc28553139c675b1a78995a7
- SHA512
  
  6fbbb77766ee9846d6d3bde2ced5eeaafe721de5524a410a4821dfa6c08edbd00905bec2b9237b8f7986d6d06dbe444c5845130193da537cadaf29ea784c48e1
- SSDEEP
  
  12288:fFrCZUcfGI/O+bE9krdFFM5lle0dkM4X2n08ukSIAg6wQEKZm+jWodEEVrR+:9rCZUNYX2nSkGg6wQEKZm+jWodEE9R+
Score

1^/10
behavioral5