Extracted

• • Target

    6ca26fbe131ceb76d05709c5df672110dc50148c791d8079eeb7d988025aef46

  • Size

    5.1MB

  • MD5

    bddbc9360dfb7c83b96437a0ca77aae1

  • SHA1

    88c82298dd32e2826743caeca5b82acf6583eee7

  • SHA256

    6ca26fbe131ceb76d05709c5df672110dc50148c791d8079eeb7d988025aef46

  • SHA512

    2a066a7e0b38d1c755d67757e4fe67eb12fefcce4aca078ae5f3f554cfd60415a5676c82a0d9eb6de9eef9327cee8eb1038f45d730fa2314e561ea2120f21224

  • SSDEEP

    98304:YNd6oQypwQq73QOB6+KPZtshYIyVGf+GBycKgeE7lXK:Yb6oQewQqbQO0+KPLsiVs+GVKjE7l6

  Score

  10^/10

  privateloaderdiscoveryevasionloaderthemidatrojan

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • Privateloader family

    privateloader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2