privateloader | fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3 | Triage

Submit
Reports

Overview

overview

Static

static

7

fcd465bfb2...d3.exe

windows7-x64

fcd465bfb2...d3.exe

windows10-2004-x64

Sharing

General

Target

fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3
Size

4.1MB
Sample

241027-nm3dgsvlcn
MD5

cb4118382e3f97f0db04938a4e31e3e1
SHA1

d31dff9e56df945247cbb0598bf0c1d27aedcccf
SHA256

fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3
SHA512

a37f4faef965c33f48af389016911ba3c255f14d7b4ee33fef6e20771844abeab37a273c60ee5501ccfbb5fecce5027201d08e4344a4ddbab672449cfb7b149c
SSDEEP

98304:Ie7PCLZ0+LSlhnzXRhtvbp6DdM0NwIwUd3iXGNZ:IeDCsVzX3xoDhNbfd3iKZ

Score

10^/10

privateloader evasion loader themida trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3.exe

Resource

win7-20241010-en

privateloader evasion loader themida trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3.exe

Resource

win10v2004-20241007-en

privateloader evasion loader themida trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3
- Size
  
  4.1MB
- MD5
  
  cb4118382e3f97f0db04938a4e31e3e1
- SHA1
  
  d31dff9e56df945247cbb0598bf0c1d27aedcccf
- SHA256
  
  fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3
- SHA512
  
  a37f4faef965c33f48af389016911ba3c255f14d7b4ee33fef6e20771844abeab37a273c60ee5501ccfbb5fecce5027201d08e4344a4ddbab672449cfb7b149c
- SSDEEP
  
  98304:Ie7PCLZ0+LSlhnzXRhtvbp6DdM0NwIwUd3iXGNZ:IeDCsVzX3xoDhNbfd3iKZ
Score

10^/10

privateloader evasion loader themida trojan
- Modifies firewall policy service
  evasion
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Privateloader family
  privateloader
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

privateloaderevasionloaderthemidatrojan

behavioral2

privateloaderevasionloaderthemidatrojan

© 2018-2025

Terms | Privacy