privateloader | 56167ce2a246b4292b496fc8cc5829d2f182ab363c645b89678e73e8210aa37c

General

Target
56167ce2a246b4292b496fc8cc5829d2f182ab363c645b89678e73e8210aa37c
Size 149KB
Sample241111-emgmcasgmc
SHA256 56167ce2a246b4292b496fc8cc5829d2f182ab363c645b89678e73e8210aa37c
MD5 9fc1019ff33c61d53d8489b795e47dfe
SHA1 df2cfe705ada080e744e8cb674be3bb9dc85fcf8
SHA512 c213ea6ab8871c4adb71151788c02bbf16c7b9e5e5cfbf826a9ba70eef9f1d25975b4d73fa0036f5177de3bf674d7a8c036571e568d851e9b1f5e18e0f1f8104
SSDEEP 3072:2beiGzqFFZ4VUayv/Ze6F06XL9GxRogdpEt66pufCVCrUJMBEnQeQ:tiGqFFZ4VUpHY6VpGx7KtP9uUaB0QeQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader privateloader

Malware Config

Extracted

Family

privateloader

C2

http://45.133.1.107/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
51.178.186.149

Signatures

Privateloader family
privateloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Setup.bin

File Explorer

56167ce2a246b4292b496fc8cc5829d2f182ab363c645b89678e73e8210aa37c

.zip 149KB
Setup.bin

.exe 403KB

56167ce2a246b4292b496fc8cc5829d2f182ab363c645b89678e73e8210aa37c

SHA256 56167ce2a246b4292b496fc8cc5829d2f182ab363c645b89678e73e8210aa37c
MD5 9fc1019ff33c61d53d8489b795e47dfe
SHA1 df2cfe705ada080e744e8cb674be3bb9dc85fcf8
SHA512 c213ea6ab8871c4adb71151788c02bbf16c7b9e5e5cfbf826a9ba70eef9f1d25975b4d73fa0036f5177de3bf674d7a8c036571e568d851e9b1f5e18e0f1f8104
SSDEEP 3072:2beiGzqFFZ4VUayv/Ze6F06XL9GxRogdpEt66pufCVCrUJMBEnQeQ:tiGqFFZ4VUpHY6VpGx7KtP9uUaB0QeQ
MD5 SHA1 SHA512 SSDEEP

Password

infected

Setup.bin

IMPHASH 6256ca6fb1d33cce27dff272311e3072
SHA256 506c2f513d64242fcb20ccff8c26c0ed1755fe9120b984c29ba224b311d635c3
MD5 d1b2c8ddca2f8dd02e2c132153055084
SHA1 21c011ac7406eef048c175f5887e4eb885c050d6
SHA512 ab73df911df41235159341cc8fefed284a3f9720f241b51dfe2db2ac415b3438d5fbbeacfa980a61d402edc64afeda87447ccda49b7d279fba524036e9287594
SSDEEP 6144:CbUYPg/USg7WFugabIv1pE0EAPMrGWsWDWidF0HQszCZ2Ftppb9Y81+k7pq7FLfj:CgYI/7FugagS2zO
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

39488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReadFile lstrcatA GetModuleHandleA SetCurrentDirectoryA GetModuleHandleExA CreateFileA lstrcpyA CloseHandle GetFileSize GetLastError GetProcAddress HeapFree WriteFile lstrlenA lstrcpynA WriteConsoleW QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle SetFilePointerEx GetFileType HeapAlloc LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetStringTypeW GetConsoleMode FlushFileBuffers GetConsoleOutputCP HeapSize HeapReAlloc CreateFileW DecodePointer

Sharing