MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 142aee3c05b5023b306aa9983c67e7168df45509882940470d5fa5d9b0a95eb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PrivateLoader


Vendor detections: 14


Intelligence 14 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 142aee3c05b5023b306aa9983c67e7168df45509882940470d5fa5d9b0a95eb9
SHA3-384 hash: 959179352bf682c267aa91ca0b3fc9588c4c375922b0f79b0aa2a6de217ee9c3e1d26f55b1ad1fc25bdd2b8f9ab50244
SHA1 hash: 3563fd4a82b964e3fbe737c81e923766a0e8cf97
MD5 hash: 398b20aafc2a39684d5e186925b94f3a
humanhash: ink-september-march-spaghetti
File name:file
Download: download sample
Signature PrivateLoader
Create hunting rule
File size:1'716'224 bytes
First seen:2023-08-17 14:04:13 UTC
Last seen:2023-08-18 12:40:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 24576:1HBqpeFID41OiNH4PYPXXl7XEwhSddeEX92dminTZffoJu+wEVxBUK4oG2I:CkFP7Njvl7Xyt2ginTVfd+wcxBU7p
TLSH T1AC851219BA56D9D3C2645B73ECD9263183A3A982F823D70B37D127EC1E833DA584171E
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon f4c0c8d0d8ccc8d8 (1 x PrivateLoader)
Reporter andretavare5
Tags:exe PrivateLoader


Avatar
andretavare5
Sample downloaded from https://vk.com/doc647736509_665765620?hash=PzfnP1b8P7N0zGqALmBTMUdx8HlbqzglTgL7G21MGGw&dl=r07QkrLeuzanMUy3BzLegz1F4qZ5CaHWRkNMnI61xus&api=1&no_preview=1#kisrise

Intelligence

File Origin
# of uploads :
4
# of downloads :
313
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-08-17 14:05:45 UTC
Tags:
risepro stealer
Link:
https://app.any.run/tasks/9c8d306e-be3c-4032-8d20-4e59432267c3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/443218/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.29643.18334.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file
Forced shutdown of a system process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/142aee3c05b5023b306aa9983c67e7168df45509882940470d5fa5d9b0a95eb9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9cb1fcaa-1547-45ac-9e00-d6154e8c4f56
Result
Threat name:
Clipboard Hijacker, PrivateLoader, RiseP
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1292816
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Clipboard Hijacker
Yara detected PrivateLoader
Yara detected RisePro Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1292816 Sample: file.exe Startdate: 17/08/2023 Architecture: WINDOWS Score: 100 38 ipinfo.io 2->38 40 cdn.discordapp.com 2->40 52 Snort IDS alert for network traffic 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 Antivirus detection for dropped file 2->56 58 10 other signatures 2->58 10 file.exe 3 2->10         started        12 oobeldr.exe 2->12         started        signatures3 process4 signatures5 15 vbc.exe 51 10->15         started        68 Antivirus detection for dropped file 12->68 70 Multi AV Scanner detection for dropped file 12->70 72 Detected unpacking (changes PE section rights) 12->72 20 schtasks.exe 1 12->20         started        process6 dnsIp7 42 194.169.175.123, 49761, 50500 CLOUDCOMPUTINGDE Germany 15->42 44 ipinfo.io 34.117.59.81, 443, 49762 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 15->44 46 cdn.discordapp.com 162.159.129.233, 443, 49763, 49764 CLOUDFLARENETUS United States 15->46 32 C:\Users\user\...\Spfo6py7niCN2ZLx9Out.exe, MS-DOS 15->32 dropped 34 C:\Users\user\AppData\Local\...\KLIPE[1].exe, MS-DOS 15->34 dropped 48 Tries to steal Mail credentials (via file / registry access) 15->48 50 Tries to harvest and steal browser information (history, passwords, etc) 15->50 22 Spfo6py7niCN2ZLx9Out.exe 1 15->22         started        26 conhost.exe 20->26         started        file8 signatures9 process10 file11 36 C:\Users\user\AppData\Roaming\...\oobeldr.exe, MS-DOS 22->36 dropped 60 Antivirus detection for dropped file 22->60 62 Multi AV Scanner detection for dropped file 22->62 64 Detected unpacking (changes PE section rights) 22->64 66 Uses schtasks.exe or at.exe to add and modify task schedules 22->66 28 schtasks.exe 1 22->28         started        signatures12 process13 process14 30 conhost.exe 28->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/142aee3c05b5023b306aa9983c67e7168df45509882940470d5fa5d9b0a95eb9/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-08-17 14:05:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cqvo4pafwubdwmdkvgmdyz7hc2g7ivijrauuarynl6s5tmfjl24q._file
Verdict:
malicious
Result
Malware family:
privateloader
Create hunting rule
Score:
  10/10
Tags:
family:privateloader loader
Link:
https://tria.ge/reports/230817-rdtxjabd51/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Executes dropped EXE
Uses the VBS compiler for execution
Downloads MZ/PE file
PrivateLoader
Malware Config
C2 Extraction:
1.1.1.1
Unpacked files
SH256 hash:
7307b42a1e25b3a6e376bbf246916e0b71e27c2c09fdeed14fa7a3c7b677868b
MD5 hash:
611af5f1dbaa7a54dad2be40198d8367
SHA1 hash:
7d3b5ee5dcd56676c1ac39c63493e863e6e52d9b
Detections:
RiseProXorStr
Create hunting rule
win_privateloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/5bf34522-714c-49a6-bc2e-e915a546f837/
Parent samples :
6eb58443e4186740619e7fb0e391a47517ce63ba4db0bd1fb4ce007c543db2be
7307b42a1e25b3a6e376bbf246916e0b71e27c2c09fdeed14fa7a3c7b677868b
142aee3c05b5023b306aa9983c67e7168df45509882940470d5fa5d9b0a95eb9
77b840bcbcda735a7e2b67f915fdfeb87ebc5324bff776ee7393a65d1a6ddf76
53c5d36676ffee894793d3d850769635289feb25fe16aeff2bfcf3d8aa510c8b
SH256 hash:
5bb5ba25eec3a0b73916ce170b187c7c2db415b0de3f3a30f73188408ae0f8ef
MD5 hash:
14af7d4e29a93b33ef1155e7be3d9b08
SHA1 hash:
2ebc2298c8a083539a5291725012ddfb56e96b60
Link:
https://www.unpac.me/results/5bf34522-714c-49a6-bc2e-e915a546f837/
SH256 hash:
198a65f6a3f780f1a022f030629e8561c31cc555a113f570a566d40d1ee56a05
MD5 hash:
9b3a1b5d3ffe9fb9db6c5aaefa1ae076
SHA1 hash:
0da05e4c72430da0d061a02cd6cf50c41e6bd83a
Link:
https://www.unpac.me/results/5bf34522-714c-49a6-bc2e-e915a546f837/
SH256 hash:
142aee3c05b5023b306aa9983c67e7168df45509882940470d5fa5d9b0a95eb9
MD5 hash:
398b20aafc2a39684d5e186925b94f3a
SHA1 hash:
3563fd4a82b964e3fbe737c81e923766a0e8cf97
Link:
https://www.unpac.me/results/5bf34522-714c-49a6-bc2e-e915a546f837/
Malware family:
PrivateLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/142aee3c05b5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/142aee3c05b5023b306aa9983c67e7168df45509882940470d5fa5d9b0a95eb9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with unregistered version of .NET Reactor
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:privateloader
Create hunting rule
Author:andretavare5
Description:PrivateLoader pay-per-install malware
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_privateloader
Create hunting rule
Author:andretavare5
Reference:https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service
Rule name:win_privateloader_w0
Create hunting rule
Author:andretavare5
Reference:https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/443218/

Comments