privateloader | fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6 | Triage

Submit
Reports

Overview

overview

Static

static

7

fcc22a367e...a6.exe

windows7-x64

fcc22a367e...a6.exe

windows10-2004-x64

Sharing

General

Target

fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6
Size

3.8MB
Sample

241027-nmrlzsvlcm
MD5

193692e1cf957eef7e6cf2f6bc74be86
SHA1

9d1f849b57c96ca71f0f90c73de97fa912b691d7
SHA256

fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6
SHA512

d0bcad2b98e5efc9c767f9a6ad87a6d62638131753bff22b21b883d90c23be17b65594b6d8c4510b255f28806b2a1dc2a01fc0e2138c3146d6e64abcd4a37697
SSDEEP

98304:agjjIlB/cHzyG0hlcX8fjr3oS6QLErN4QkMvqs:agwUTyGR8rqa7QkMis

Score

10^/10

privateloader evasion loader themida trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6.exe

Resource

win7-20240903-en

privateloader evasion loader themida trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6.exe

Resource

win10v2004-20241007-en

privateloader evasion loader themida trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6
- Size
  
  3.8MB
- MD5
  
  193692e1cf957eef7e6cf2f6bc74be86
- SHA1
  
  9d1f849b57c96ca71f0f90c73de97fa912b691d7
- SHA256
  
  fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6
- SHA512
  
  d0bcad2b98e5efc9c767f9a6ad87a6d62638131753bff22b21b883d90c23be17b65594b6d8c4510b255f28806b2a1dc2a01fc0e2138c3146d6e64abcd4a37697
- SSDEEP
  
  98304:agjjIlB/cHzyG0hlcX8fjr3oS6QLErN4QkMvqs:agwUTyGR8rqa7QkMis
Score

10^/10

privateloader evasion loader themida trojan
- Modifies firewall policy service
  evasion
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Privateloader family
  privateloader
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

privateloaderevasionloaderthemidatrojan

behavioral2

privateloaderevasionloaderthemidatrojan

© 2018-2024

Terms | Privacy