MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2cd2f077ca597ad0ef234a357ea71558d5e039da9df9958d0b8bd0efa92e74c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PrivateLoader


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2cd2f077ca597ad0ef234a357ea71558d5e039da9df9958d0b8bd0efa92e74c9
SHA3-384 hash: f9880efa3aee61b4888cf0ddfb4e36c3f1ed611a651755182e3fbd622eacb271ffba1466289daece626e050383e91800
SHA1 hash: b591420efba52c159e65416c494b659220cce780
MD5 hash: c05c3268a8a06af406d33e1a8a77c937
humanhash: equal-coffee-oxygen-maryland
File name:file
Download: download sample
Signature PrivateLoader
Create hunting rule
File size:994'816 bytes
First seen:2023-06-10 23:10:30 UTC
Last seen:2023-06-16 06:28:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4bad0a7f5ca6ee2a6df2f922510809b4 (1 x PrivateLoader)
ssdeep 24576:Kog0b4/rp+pGnDtLaRwLCfTp99oZJU2DEcTCNaO:E7/rp+pGnDVapToEcTnO
TLSH T10B25B011E7529032ECA21470219D9F769EFC7830417AA9ABDFD03E9A8D737C1922539F
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter andretavare5
Tags:exe PrivateLoader


Avatar
andretavare5
Sample downloaded from https://vk.com/doc228185173_661370278?hash=WTDcb1YK5NnIvYroFodebWklmNOZDA4t4wzyM7YZ8G0&dl=Opv8Kz3cxkmZtk6x6eARTW2stAo0pDAlyAS3QYoyGZT&api=1&no_preview=1#rise_test

Intelligence

File Origin
# of uploads :
30
# of downloads :
299
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-06-10 23:13:21 UTC
Tags:
privateloader
Link:
https://app.any.run/tasks/33caef86-2280-4768-b575-167e86297d56

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/397649/
Detection(s):
SecuriteInfo.com.W32.Agent.ADVG.tr.4761.6322.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/90225/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto fingerprint greyware lolbin privateloader setupapi.dll shell32.dll
Link:
https://www.filescan.io/uploads/648503082f1f19d7eaef82d8/reports/d94a41c7-12d3-4f66-b79b-6685cabfe60a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/2cd2f077ca597ad0ef234a357ea71558d5e039da9df9958d0b8bd0efa92e74c9
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c3cd88ea-b0c4-4cb7-bfcb-23c5755ae732
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1252454
Signature
Found stalling execution ending in API Sleep call
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2cd2f077ca597ad0ef234a357ea71558d5e039da9df9958d0b8bd0efa92e74c9/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Suspicious
First seen:
2023-06-10 16:40:07 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ftjpa56klf5nb3zdji2x5jyvldk6aoo2tx4zldilrpio7kjooteq._file
Verdict:
malicious
Result
Malware family:
privateloader
Create hunting rule
Score:
  10/10
Tags:
family:privateloader
Link:
https://tria.ge/reports/230610-259geaga34/
Unpacked files
SH256 hash:
2cd2f077ca597ad0ef234a357ea71558d5e039da9df9958d0b8bd0efa92e74c9
MD5 hash:
c05c3268a8a06af406d33e1a8a77c937
SHA1 hash:
b591420efba52c159e65416c494b659220cce780
Detections:
PrivateLoader
Create hunting rule
win_privateloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/7677d8fa-e719-4023-8ef3-e08f14dc1d77/
Malware family:
PrivateLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2cd2f077ca59/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2cd2f077ca597ad0ef234a357ea71558d5e039da9df9958d0b8bd0efa92e74c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:privateloader
Create hunting rule
Author:andretavare5
Description:PrivateLoader pay-per-install malware
Rule name:win_privateloader
Create hunting rule
Author:andretavare5
Reference:https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service
Rule name:win_privateloader_w0
Create hunting rule
Author:andretavare5
Reference:https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/397649/

Comments