privateloader | 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F[.]exe

General

Target
611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe
Size 402KB
Sample240724-sefa7svenf
SHA256 9664f55603f168dc5f7ac498789f5275b2c64fb5ad1bc7c185944421bd5a8777
MD5 5ae2c7e495880d7e209a41158fd72984
SHA1 f2bd4549f77a5c6af49259b60caf937b31decbf0
SHA512 16364431e2d8b0e48189f571b1b713da08129ea3b00d18723d981b7ace39b9d1cd7b55d4a48ea53bb8e7940f0c76ef70b5614a5a8d08bdb73827539e4cc7d5cf
SSDEEP 12288:MZFjgB8S7dgKfFTJnUxzJQK2LM0r04JduPK1LOE/BE:M3jgCS7BFnUbR60wLLOSi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader privateloader

Malware Config

Extracted

Family

privateloader

C2

http://212.193.30.45/proxies.txt
http://212.193.30.29/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
212.193.30.21

Attributes

payload_url
https://vipsofts.xyz/files/mega.bmp

Signatures

Privateloader family
privateloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

File Explorer

611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

.exe 402KB

611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

IMPHASH 9734ba8626408cec04bb8fa7d8bb6e83
SHA256 9664f55603f168dc5f7ac498789f5275b2c64fb5ad1bc7c185944421bd5a8777
MD5 5ae2c7e495880d7e209a41158fd72984
SHA1 f2bd4549f77a5c6af49259b60caf937b31decbf0
SHA512 16364431e2d8b0e48189f571b1b713da08129ea3b00d18723d981b7ace39b9d1cd7b55d4a48ea53bb8e7940f0c76ef70b5614a5a8d08bdb73827539e4cc7d5cf
SSDEEP 12288:MZFjgB8S7dgKfFTJnUxzJQK2LM0r04JduPK1LOE/BE:M3jgCS7BFnUbR60wLLOSi
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

409600

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateDirectoryA IsWow64Process lstrcatA GetModuleHandleA lstrcpyA WinExec lstrlenA HeapAlloc GetProcAddress lstrcpynA GetProcessHeap WriteConsoleW LocalFree GetWindowsDirectoryA CloseHandle DeleteFileA LoadLibraryA GetFileAttributesA GetLastError CopyFileA Sleep LocalAlloc GetVolumeInformationA GetCurrentProcess HeapFree GetModuleFileNameA SetEndOfFile HeapReAlloc HeapSize ReadConsoleW ReadFile FlushFileBuffers CreateFileW GetStringTypeW SetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile MultiByteToWideChar LCMapStringW MoveFileExW GetFileType GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW DecodePointer

advapi32

CreateServiceA RegCloseKey StartServiceCtrlDispatcherA GetCurrentHwProfileA CloseServiceHandle RegQueryValueExA SetServiceStatus RegisterServiceCtrlHandlerA OpenSCManagerA GetUserNameA StartServiceA RegOpenKeyExA OpenServiceA

shell32

SHGetSpecialFolderPathA SHGetFolderPathA ShellExecuteA

setupapi

SetupDiGetClassDevsA SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInfo

Name

.text

Size

328KB

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

k��u

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

kernel32

advapi32

shell32

setupapi

generic