Overview

overview

10

Static

static

3

Setup.exe

windows7-x64

10

Setup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c5804a0817e2b87fee53ea06dfa7880ebd078a09c573653f73d3b043dc191bc0

  • Size

    213KB

  • Sample

    241110-d51x9s1rgn

  • MD5

    1e1d401df5fb4c93ff2b76bce0295efd

  • SHA1

    c692d50e68d0094a00baedd4790a59bc60d1aaf4

  • SHA256

    c5804a0817e2b87fee53ea06dfa7880ebd078a09c573653f73d3b043dc191bc0

  • SHA512

    930f1df0313438a5019274c62b5a9dfaaf75ba6df84c38822e6770828f6a50d02077d6f90caa49df3878aa552337e83aed9e21ae49f113e40964f2b9e8f935a7

  • SSDEEP

    3072:ZUvMAztEwZQFFncpWXFdeO2YygEiq1E8hQA3nBEE7yCsbEIgJ3CVkunhnq/36:ZWhQFy6rejiiE86A3BDyCsbE3hMZnhA6

Score
10/10
privateloaderdiscoveryloader

Malware Config

Extracted

Family

privateloader

C2

http://212.193.30.45/proxies.txt

http://45.144.225.57/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

2.56.59.42

Targets

    • Target

      Setup.bin

    • Size

      365KB

    • MD5

      795ce67cb525ba86787c5798be9743b0

    • SHA1

      06fff7597dac5f80c3908c58f54ad627785329e8

    • SHA256

      1cad831d1d3b9981f3545c394f93dd0944965cc3c3fc969aa1265b91066ceb93

    • SHA512

      bcc25e1706cf4e630f09eef301a11af73b46803918478464bc99c6c2131cdd6dd2a8b85f20f977fe37286b1ecb1e1c7382d4885d3f20807b83738c72a1a17f52

    • SSDEEP

      6144:g/6bm/6MGEtDn5v86mi/DudxVRbmCigaA:gt/nGEtt86mi/Duzbmn

    Score
    10/10
    privateloaderdiscoveryloader

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Privateloader family

      privateloader

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks