Overview

overview

10

Static

static

3

2026-11-06...ca.exe

windows10-2004-x64

10

2026-11-06...ca.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-11-06_d5adc04d12f259a87b8ee71296d1d360_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil
  • Size 6.0MB
  • Sample261107-12vy6sgd22
  • SHA256 2fb0a0549c515ba532e90c20e2dbb98473683f709075318d99c6e042f99c97c0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
privateloaderbootkitdefense_evasiondiscoveryloaderpersistencespywaretrojan

Malware Config

Targets

    • Target
      2026-11-06_d5adc04d12f259a87b8ee71296d1d360_amadey_avoslocker_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_magniber_njrat_revil
    • Size 6.0MB
    • SHA256 2fb0a0549c515ba532e90c20e2dbb98473683f709075318d99c6e042f99c97c0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bootkitdefense_evasiondiscoveryprivateloaderloaderpersistencespywaretrojan

    • Family: PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • Executes dropped EXE

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Writes a Windows system DLL name to a user directory

      A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

      defense_evasion

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks