privateloader | hxxps://dw[.]uptodown[.]net/dwn/-WuOmKHWV3TzndwnwLuDzSa3iVvwM9a0m-yr3Kh3Kuh2tB5ayDCSzqDZIzFthUHHc_jTw2SeQYWz-nJ02p3cpWEkzUNeIFQDZrhOVZlWHH3AV9YE8WdDHmay-_2gJrUw/v5E_KLu8ydk8Zfor7ITM88qP12jvEgZeO1583s6lGIBurOY3Hwm1-9v0naMc2iby35c_gECvz7RGokBrhga-7cdJ08brChpJzL5gVWKzStdMTM_frFvttvlY3_mCk8X5/iqC2TzKGsuAS7skmWCwHQEMUJxh5F4nZvmlScjarOw8Ll2NcFFxQUop-UWWDHhTBGFLc6HxdJYlHc1-FfzpkiN0mKKXCMCgbklSEaDuAyZ8IlBn0njIiH6KCh-YxjGRT/idmGNcZGALV-dKGV7jveiOWQ9y64_7ZBqg3oq0sW8MQ=/norton-antivirus-22-20-5-39[.]exe

General

Target
https://dw.uptodown.net/dwn/-WuOmKHWV3TzndwnwLuDzSa3iVvwM9a0m-yr3Kh3Kuh2tB5ayDCSzqDZIzFthUHHc_jTw2SeQYWz-nJ02p3cpWEkzUNeIFQDZrhOVZlWHH3AV9YE8WdDHmay-_2gJrUw/v5E_KLu8ydk8Zfor7ITM88qP12jvEgZeO1583s6lGIBurOY3Hwm1-9v0naMc2iby35c_gECvz7RGokBrhga-7cdJ08brChpJzL5gVWKzStdMTM_frFvttvlY3_mCk8X5/iqC2TzKGsuAS7skmWCwHQEMUJxh5F4nZvmlScjarOw8Ll2NcFFxQUop-UWWDHhTBGFLc6HxdJYlHc1-FfzpkiN0mKKXCMCgbklSEaDuAyZ8IlBn0njIiH6KCh-YxjGRT/idmGNcZGALV-dKGV7jveiOWQ9y64_7ZBqg3oq0sW8MQ=/norton-antivirus-22-20-5-39.exe
Sample261017-tqbb3afg95

Score

10^/10

Malware Config

Targets

- Target
  https://dw.uptodown.net/dwn/-WuOmKHWV3TzndwnwLuDzSa3iVvwM9a0m-yr3Kh3Kuh2tB5ayDCSzqDZIzFthUHHc_jTw2SeQYWz-nJ02p3cpWEkzUNeIFQDZrhOVZlWHH3AV9YE8WdDHmay-_2gJrUw/v5E_KLu8ydk8Zfor7ITM88qP12jvEgZeO1583s6lGIBurOY3Hwm1-9v0naMc2iby35c_gECvz7RGokBrhga-7cdJ08brChpJzL5gVWKzStdMTM_frFvttvlY3_mCk8X5/iqC2TzKGsuAS7skmWCwHQEMUJxh5F4nZvmlScjarOw8Ll2NcFFxQUop-UWWDHhTBGFLc6HxdJYlHc1-FfzpkiN0mKKXCMCgbklSEaDuAyZ8IlBn0njIiH6KCh-YxjGRT/idmGNcZGALV-dKGV7jveiOWQ9y64_7ZBqg3oq0sW8MQ=/norton-antivirus-22-20-5-39.exe
Score

10^/10

adware defense_evasion discovery privateloader loader persistence privilege_escalation spyware stealer trojan
- Family: PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1