privateloader | 041fa6acb0d512cd68e538d2e4bd11a9a1345839d3803ec8c096862eafc0cd81 | Triage

Sharing

General

Target

574843ce13304217f897e35ccfa66118_JaffaCakes118
Size

1.6MB
Sample

241018-nzt8msvflc
MD5

574843ce13304217f897e35ccfa66118
SHA1

19671765f1d4db74a1a9bca2911ff8f3d9633a81
SHA256

041fa6acb0d512cd68e538d2e4bd11a9a1345839d3803ec8c096862eafc0cd81
SHA512

3d344e2208a0b00775b64cc897cd47d29b507f7da2416270cd3b2594a3379b12786ad29c14682259843ce0a1f176d15fa7406639ba11f71e1d01a1899be04427
SSDEEP

24576:5E6IrX+7auPGoX8DqTyECMkDwff7h0cykj3uBL8hxCMcIYwTxKAyuxCQyD2uG8wM:5sMeBQxC/wTW2owTt8fpSKc

Score

10^/10

privateloader discovery evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  574843ce13304217f897e35ccfa66118_JaffaCakes118
- Size
  
  1.6MB
- MD5
  
  574843ce13304217f897e35ccfa66118
- SHA1
  
  19671765f1d4db74a1a9bca2911ff8f3d9633a81
- SHA256
  
  041fa6acb0d512cd68e538d2e4bd11a9a1345839d3803ec8c096862eafc0cd81
- SHA512
  
  3d344e2208a0b00775b64cc897cd47d29b507f7da2416270cd3b2594a3379b12786ad29c14682259843ce0a1f176d15fa7406639ba11f71e1d01a1899be04427
- SSDEEP
  
  24576:5E6IrX+7auPGoX8DqTyECMkDwff7h0cykj3uBL8hxCMcIYwTxKAyuxCQyD2uG8wM:5sMeBQxC/wTW2owTt8fpSKc
Score

10^/10

discovery evasion spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionspywarestealertrojan

behavioral2

discoveryevasionspywarestealertrojan