MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1decb96425907cdf59a1cb7382c479b220792dcca81e77c58141b118153b5cbe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PrivateLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1decb96425907cdf59a1cb7382c479b220792dcca81e77c58141b118153b5cbe
SHA3-384 hash: e8bb98e42f6b9cca1d04ed117a8b7623ec547281ea3787b82ad536096cf00157e04e3df3c95efdc8be0d01723c1d0787
SHA1 hash: e246a339d413da0f14a862dbfb5da72db1cd81a6
MD5 hash: 4a3e42ac8a4e95f4a9a0b6c86ec95499
humanhash: edward-sodium-romeo-orange
File name:file
Download: download sample
Signature PrivateLoader
Create hunting rule
File size:1'077'248 bytes
First seen:2022-08-23 12:36:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d17f84051bcd59e28347bf9bc7d82e43 (2 x RedLineStealer, 1 x ArkeiStealer, 1 x PrivateLoader)
ssdeep 24576:P+rnfIBrh44TkO3E2tKeyL/RbvwY7q4SsZRQw:P3r/E2tKt/t57q4Hyw
Threatray 4'028 similar samples on MalwareBazaar
TLSH T105351200EB90D435F8FB66F499BA526CB82E7BA06B2544CB12D516EE1734AE1FC30357
TrID 40.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.0% (.SCR) Windows screen saver (13101/52/3)
13.6% (.EXE) Win64 Executable (generic) (10523/12/4)
8.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 25ac137039939b91 (15 x Smoke Loader, 12 x Amadey, 6 x RedLineStealer)
Reporter andretavare5
Tags:exe PrivateLoader


Avatar
andretavare5
Sample downloaded from https://cdn.discordapp.com/attachments/1011602243293818931/1011614451578966097/StealerClient-1_2022-08-23_15-27.bmp

Intelligence

File Origin
# of uploads :
1
# of downloads :
319
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
No threats detected
Analysis date:
2022-08-23 12:38:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a0b41bfc-d1c4-4498-a5f9-bc2160636d47

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/300564/
Detection(s):
Win.Packed.Crypterx-9964586-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
DNS request
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/29801/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
EvasionGetTickCount
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6304ca3fc9bbd990978b1bef/reports/f029e600-b052-4295-9fb7-c91d37e9b74a/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/418ff279-356f-4d24-9682-f927f117511a
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1056242
Signature
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 688760 Sample: file.exe Startdate: 23/08/2022 Architecture: WINDOWS Score: 76 51 Malicious sample detected (through community Yara rule) 2->51 53 Multi AV Scanner detection for dropped file 2->53 55 Machine Learning detection for sample 2->55 57 Found many strings related to Crypto-Wallets (likely being stolen) 2->57 6 file.exe 31 2->6         started        process3 dnsIp4 43 ipinfo.io 34.117.59.81, 443, 49779 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 6->43 45 104.21.89.238, 443, 49773 CLOUDFLARENETUS United States 6->45 47 gamefilescript.com 172.67.191.237, 443, 49758, 49771 CLOUDFLARENETUS United States 6->47 21 C:\Users\user\AppData\...\libcrypto-3.dll, PE32 6->21 dropped 23 C:\Users\user\AppData\...\vcruntime140.dll, PE32 6->23 dropped 25 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 6->25 dropped 27 4 other files (none is malicious) 6->27 dropped 59 May check the online IP address of the machine 6->59 61 Tries to steal Mail credentials (via file / registry access) 6->61 63 Tries to harvest and steal browser information (history, passwords, etc) 6->63 11 WerFault.exe 9 6->11         started        15 WerFault.exe 9 6->15         started        17 WerFault.exe 9 6->17         started        19 6 other processes 6->19 file5 signatures6 process7 dnsIp8 49 192.168.2.1 unknown unknown 11->49 29 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 11->29 dropped 31 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 15->31 dropped 33 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 17->33 dropped 35 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 19->35 dropped 37 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 19->37 dropped 39 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 19->39 dropped 41 3 other malicious files 19->41 dropped file9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1decb96425907cdf59a1cb7382c479b220792dcca81e77c58141b118153b5cbe/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-08-23 12:37:10 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
24 of 25 (96.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dxwlszbfsb6n6wnbznzyfrdzwiqhslomvaphprmbigyrqfj3ls7a._file
Verdict:
malicious
Similar samples:
0d0be8ecc5e7c7d3fb48665b5860aa8eb97d367f58af0de01e8bcff3861f4c52
PrivateLoader
0e45e4518520737de10107dd9f0ef027bc21e3579ded4f3e38e8f92f1e2dd32d
PrivateLoader
2478438ca47c4cd97263a6382359146e9db261300f0495cfb50a51f2833c7f60
PrivateLoader
367f9b98835a1c98ee8542f2009ccb23b4ef42ff7117e5774968196cfb43ac3e
PrivateLoader
4a9579d10dc37c2010e162741e19938e25d10e90a3de0d7632504cb6b9ed13e2
PrivateLoader
a297bc0c90017b32dd1636f86f068b0b6c21c6e1eb1ead92c23eec4b0195177e
PrivateLoader
b52165d1dff358f826708910f6b025e710bc1ba9c975597e38acdecc0b9eff28
PrivateLoader
c3c42af61eaeb76c2a3ea4712a4fda9d25e83e91f4fa2b5f1236c5d76688fc43
PrivateLoader
e0579dc3a1e48845194d9cd9415ae492d375fd59cea0e1adf21866afde152f89
PrivateLoader
+ 4'018 additional samples on MalwareBazaar
Result
Malware family:
privateloader
Create hunting rule
Score:
  10/10
Tags:
family:privateloader discovery loader spyware stealer
Link:
https://tria.ge/reports/220823-ptf99shff5/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Program crash
Checks installed software on the system
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
PrivateLoader
Unpacked files
SH256 hash:
be2a5d0f95ee7cb9c12fea0820452b65c949ad9ed13a6c776ef512dae5754d6e
MD5 hash:
612898cd0ad614c9e55a3ef37a2b8796
SHA1 hash:
6b9350c87a876aef0e750ed7a32ea6d9ab6fd186
Detections:
win_privateloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/9aac2e3e-9e42-417e-821b-f5075919614b/
SH256 hash:
1decb96425907cdf59a1cb7382c479b220792dcca81e77c58141b118153b5cbe
MD5 hash:
4a3e42ac8a4e95f4a9a0b6c86ec95499
SHA1 hash:
e246a339d413da0f14a862dbfb5da72db1cd81a6
Link:
https://www.unpac.me/results/9aac2e3e-9e42-417e-821b-f5075919614b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1decb9642590/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1decb96425907cdf59a1cb7382c479b220792dcca81e77c58141b118153b5cbe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:privateloader
Create hunting rule
Author:andre@tavares.re
Description:PrivateLoader pay-per-install malware
Rule name:win_privateloader_w0
Create hunting rule
Author:andretavare5
Reference:https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/300564/

Comments