privateloader | 1cdddf182f161ab789edfcc68a0706d0b8412a9ba67a3f918fe60fab270eabff | Triage

Sharing

General

Target

0965da18bfbf19bafb1c414882e19081_JaffaCakes118
Size

1.6MB
Sample

241002-hlan7awdnb
MD5

0965da18bfbf19bafb1c414882e19081
SHA1

e4556bac206f74d3a3d3f637e594507c30707240
SHA256

1cdddf182f161ab789edfcc68a0706d0b8412a9ba67a3f918fe60fab270eabff
SHA512

fe4702a2fde36b4fb0015ad7d3e2169a1ccbf5e29d7edef40f104ed47661b4b0365b13b1913e9f4e0ab7bc9ac542ee86c02a802a13567dfd0b8f5485a5be829b
SSDEEP

24576:/IBprJ8XdBig7LxureALwLhuhDUauBL8hxCMcIYwTxKAyuxCQyD2uG8wTVXglfg+:/17bBQxC/wTW2owTh8fpSKc

Score

10^/10

privateloader discovery evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  0965da18bfbf19bafb1c414882e19081_JaffaCakes118
- Size
  
  1.6MB
- MD5
  
  0965da18bfbf19bafb1c414882e19081
- SHA1
  
  e4556bac206f74d3a3d3f637e594507c30707240
- SHA256
  
  1cdddf182f161ab789edfcc68a0706d0b8412a9ba67a3f918fe60fab270eabff
- SHA512
  
  fe4702a2fde36b4fb0015ad7d3e2169a1ccbf5e29d7edef40f104ed47661b4b0365b13b1913e9f4e0ab7bc9ac542ee86c02a802a13567dfd0b8f5485a5be829b
- SSDEEP
  
  24576:/IBprJ8XdBig7LxureALwLhuhDUauBL8hxCMcIYwTxKAyuxCQyD2uG8wTVXglfg+:/17bBQxC/wTW2owTh8fpSKc
Score

10^/10

discovery evasion spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionspywarestealertrojan

behavioral2

discoveryevasionspywarestealertrojan