Extracted

• • Target

    50149ae9338f1b279ade6b7c0d196e78cebaf39af16463ab43148dcd64524efe

  • Size

    723.8MB

  • MD5

    ba40babd45125190db63df7c47d2f225

  • SHA1

    c4a4b59c924c16bf4aecb60a875bb418f6c4bd66

  • SHA256

    50149ae9338f1b279ade6b7c0d196e78cebaf39af16463ab43148dcd64524efe

  • SHA512

    a52103d34bf3010ee7f363ad3bea2dc1764bdbda4ed951cc947187d1d697c11a071760b44ab34257a0ecb1d64348c60c06af3a755d91d8dff54ba6add6845f95

  • SSDEEP

    98304:dp6Ni2CCmlA2TdkrvHFG8RM2m5sEMznmW57/dRH3MPEFP9m3BGm3xFuQbo9/bgCr:iQN9MvHFFM2bnTmg1RHcPemMaTCr

  Score

  10^/10

  privateloaderdiscoveryevasionloadermainspywarestealertrojan

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • Privateloader family

    privateloader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2