privateloader

General

Target
3d8a1274c158597b5f19a3a5e3585359.bin
Size 30.1MB
Sample240730-cbp38ssbjp
SHA256 86b81bf7f83767c4934acaacdc5969d71c3ba8d897447993a4a6ebaaf23dfb6b
MD5 3d8a1274c158597b5f19a3a5e3585359
SHA1 2e230262da6e67c3453f3a27d71f85368db28797
SHA512 76031a816caa45a30d4cc14299b4d5b61a63f829212239db53e616e93503da62589c1fc4c62e16dec7e9d9ef4b7fb997ada6ea3d471585a5ee6ec57ad0ef9f29
SSDEEP 786432:bCG6YUg4E4NakUtnEfz7vr85ienl0Zsgf68S1eQ/7:GG6YU1E4NNY5grS1eQ/7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\@[email protected]

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

- Target
  3d8a1274c158597b5f19a3a5e3585359.bin
- Size 30.1MB
- SHA256 86b81bf7f83767c4934acaacdc5969d71c3ba8d897447993a4a6ebaaf23dfb6b
- MD5 3d8a1274c158597b5f19a3a5e3585359
- SHA1 2e230262da6e67c3453f3a27d71f85368db28797
- SHA512 76031a816caa45a30d4cc14299b4d5b61a63f829212239db53e616e93503da62589c1fc4c62e16dec7e9d9ef4b7fb997ada6ea3d471585a5ee6ec57ad0ef9f29
- SSDEEP 786432:bCG6YUg4E4NakUtnEfz7vr85ienl0Zsgf68S1eQ/7:GG6YU1E4NNY5grS1eQ/7
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

privateloader xmrig defense_evasion discovery loader miner upx vmprotect wannacry execution ransomware worm
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies file permissions
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2