MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35fffa08860b13647a48871f06c2b8d6524e2b28e0b48bd853e32d4ce9a65aab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PrivateLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35fffa08860b13647a48871f06c2b8d6524e2b28e0b48bd853e32d4ce9a65aab
SHA3-384 hash: 93c3d9e51f6cfbd06ce09191a72bd7e016e5275d21414acf4fbaef1d1b144dcb10a0379984af533606fd7fd64947177d
SHA1 hash: d779f5cc6bb20d867432497425183da1c8035e30
MD5 hash: 409588f8bffa9034c6a916891da00bb2
humanhash: seven-ack-blue-kansas
File name:file
Download: download sample
Signature PrivateLoader
Create hunting rule
File size:4'086'784 bytes
First seen:2022-11-04 11:29:53 UTC
Last seen:2022-11-04 14:12:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e412cb3cd2101fa7976d1b955d53f138 (7 x RedLineStealer, 4 x Smoke Loader, 1 x DanaBot)
ssdeep 98304:Qbf1EN37kV5/i7w7k7+rivGsBt0eDTnqgQavw1j:/5kVwb7+rXsf0UqBj
Threatray 4'215 similar samples on MalwareBazaar
TLSH T1591633417DB5AC33DE624A789D14E6A02A37343A666456077F18BF6184F0302F878BFB
TrID 62.2% (.EXE) InstallShield setup (43053/19/16)
15.2% (.EXE) Win64 Executable (generic) (10523/12/4)
7.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.5% (.EXE) Win32 Executable (generic) (4505/5/1)
2.9% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 480c3c4c4f590b14 (23 x Smoke Loader, 16 x Amadey, 15 x RedLineStealer)
Reporter andretavare5
Tags:exe PrivateLoader


Avatar
andretavare5
Sample downloaded from https://vk.com/doc759438714_648922308?hash=xmxk6eEJBIp1PpIl4KrRnonhjzmH42SMTICboe84AKw&dl=G42TSNBTHA3TCNA:1667561182:l7ESyPJ3MZIzGOK0lDu3xwCDzmZOBGZYbgGdGiVwlZc&api=1&no_preview=1

Intelligence

File Origin
# of uploads :
13
# of downloads :
199
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-04 11:33:03 UTC
Tags:
installer
Link:
https://app.any.run/tasks/ad9ff9f0-a879-4c29-a538-84629221167f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/328440/
Detection(s):
SecuriteInfo.com.Heur.Mint.Zard.52.21886.16656.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6364f7bdd8b92f0ee64c54db/reports/1f39361a-eb99-4c3e-a152-d13744d1629f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d9aeb442-99f8-4072-9242-526802690c7e
Result
Threat name:
PrivateLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1105348
Signature
Antivirus detection for URL or domain
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected PrivateLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 738009 Sample: file.exe Startdate: 04/11/2022 Architecture: WINDOWS Score: 88 46 Malicious sample detected (through community Yara rule) 2->46 48 Antivirus detection for URL or domain 2->48 50 Multi AV Scanner detection for dropped file 2->50 52 2 other signatures 2->52 6 file.exe 28 2->6         started        process3 dnsIp4 42 108.174.200.11, 49699, 49700, 80 HOSTWINDSUS United States 6->42 44 ipinfo.io 34.117.59.81, 443, 49698 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 6->44 20 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 6->20 dropped 22 C:\Users\user\AppData\Local\Temp\...\nss3.dll, PE32 6->22 dropped 24 C:\Users\user\AppData\Local\...\mozglue.dll, PE32 6->24 dropped 26 4 other files (1 malicious) 6->26 dropped 54 May check the online IP address of the machine 6->54 56 Tries to steal Mail credentials (via file / registry access) 6->56 58 Tries to harvest and steal browser information (history, passwords, etc) 6->58 11 WerFault.exe 9 6->11         started        14 WerFault.exe 9 6->14         started        16 WerFault.exe 9 6->16         started        18 4 other processes 6->18 file5 signatures6 process7 file8 28 C:\ProgramData\Microsoft\...\Report.wer, Unicode 11->28 dropped 30 C:\ProgramData\Microsoft\...\Report.wer, Unicode 14->30 dropped 32 C:\ProgramData\Microsoft\...\Report.wer, Unicode 16->32 dropped 34 C:\ProgramData\Microsoft\...\Report.wer, Unicode 18->34 dropped 36 C:\ProgramData\Microsoft\...\Report.wer, Unicode 18->36 dropped 38 C:\ProgramData\Microsoft\...\Report.wer, Unicode 18->38 dropped 40 C:\ProgramData\Microsoft\...\Report.wer, Unicode 18->40 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35fffa08860b13647a48871f06c2b8d6524e2b28e0b48bd853e32d4ce9a65aab/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2022-11-04 11:30:18 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gx77ucegbmjwi6siq4pqnqvy2zje4kzi4c2ixwct4mwuz2nglkvq._file
Verdict:
malicious
Similar samples:
14d0d52dd45d53a49f1bc88baebf0b5cfd60b269b5db56942d08264224061db7
PrivateLoader
534d2cccb4e3f59faffe9ebcbf20af820ec5ab0cd5f5b1a30173e2d0b017d5c9
PrivateLoader
57026c153da228745c6edff19e8d2c970394f1fde72a8aea2669dc70115def67
PrivateLoader
abb923c865ae7938904297d9ff4001af912b4d6903bc318a57b91d025404ad3d
PrivateLoader
b67123d66ddf46297d05a3f6b27e623e822afa25173159411075e7f1a19c0da1
PrivateLoader
c3fe28b7f5374239d8e2a1791431854c6d26e2bfab93994e00e3eac1a34e38e5
PrivateLoader
+ 4'205 additional samples on MalwareBazaar
Result
Malware family:
privateloader
Create hunting rule
Score:
  10/10
Tags:
family:privateloader discovery loader spyware stealer
Link:
https://tria.ge/reports/221104-nl5r8aggcn/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Program crash
Checks installed software on the system
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
PrivateLoader
Malware Config
C2 Extraction:
http://108.174.200.11/MWTSL
http://108.174.198.132/MWTSL
http://108.174.199.249/MWTSL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ce3e93d2-cef0-4bd4-a3a8-508fd43c87d0
Unpacked files
SH256 hash:
692effa4b075b4ac1a4325352bef2d1ca6db9d69625dbdabd49dbcf234088f25
MD5 hash:
a38f098fe399753fa12f7ec721de94aa
SHA1 hash:
cd94dec4b4be4492712928cc215b9fedf38939a7
Link:
https://www.unpac.me/results/7c16decf-dc8f-41e3-a8fe-1d0df333652e/
SH256 hash:
18f93578d40f4922f57af3d3d14c673157f0109d234f6773c155f5876abca9cb
MD5 hash:
624a72bfb4d1013ef52d990e882f81e7
SHA1 hash:
c189de114df66fa8812bf00b136b6a5ba1226a6b
Detections:
PrivateLoader
Create hunting rule
win_privateloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/7c16decf-dc8f-41e3-a8fe-1d0df333652e/
SH256 hash:
656fbba8ab64cb634402dc20c5c952d5c0f73d127341af1d10603d534382fde4
MD5 hash:
4b2ac287eca8122653ba72fcc30f5e89
SHA1 hash:
885fbb8e8f00556771f86e6bff78b86d5476e09b
Link:
https://www.unpac.me/results/7c16decf-dc8f-41e3-a8fe-1d0df333652e/
SH256 hash:
c1dcc4430a0273b45b3447e3010268e51e2c99924d045adc063812551e35f396
MD5 hash:
d46e095be89c714e68fe5f891654fb27
SHA1 hash:
84ed7473f661e9c81edd16762dc3a2ddda3cff3b
Link:
https://www.unpac.me/results/7c16decf-dc8f-41e3-a8fe-1d0df333652e/
SH256 hash:
588c32b6a3568b6b7704625fa53331fff623479536bb553ff0f08a5acf738ab3
MD5 hash:
0dcce2c7cc28d875e303816a71fb1343
SHA1 hash:
6dfd73742925b844b3984ddc0657cfc3de956e0c
Link:
https://www.unpac.me/results/7c16decf-dc8f-41e3-a8fe-1d0df333652e/
SH256 hash:
aeaaa4cb4915a537e5841f175302bee0c5a83f812c41eeea2665f963a5189ee4
MD5 hash:
a4b6b177d7e3dafaed7c39b8e320f1ea
SHA1 hash:
56fb42535d1efd11febe21f859c992e3e3faafdb
Link:
https://www.unpac.me/results/7c16decf-dc8f-41e3-a8fe-1d0df333652e/
SH256 hash:
87eda04a67ca4dfee714d1f66fd55461674f44c067213283e4752e27a7a93fb6
MD5 hash:
31e82aad5c10f8dcd8c0b8ec1e471108
SHA1 hash:
51745e58ad3e26838b92883968a135cb7e3db86d
Link:
https://www.unpac.me/results/7c16decf-dc8f-41e3-a8fe-1d0df333652e/
SH256 hash:
98196bd80c1a00645bcd331c25e5d09386ea4c00682548c57327c4c2f1c4ed67
MD5 hash:
e6450e61e2d9a885e1dd38d033b8b6b4
SHA1 hash:
012c9a353414764c39f6cbc68d9125d11622e44f
Link:
https://www.unpac.me/results/7c16decf-dc8f-41e3-a8fe-1d0df333652e/
SH256 hash:
35fffa08860b13647a48871f06c2b8d6524e2b28e0b48bd853e32d4ce9a65aab
MD5 hash:
409588f8bffa9034c6a916891da00bb2
SHA1 hash:
d779f5cc6bb20d867432497425183da1c8035e30
Link:
https://www.unpac.me/results/7c16decf-dc8f-41e3-a8fe-1d0df333652e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/35fffa08860b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/35fffa08860b13647a48871f06c2b8d6524e2b28e0b48bd853e32d4ce9a65aab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:privateloader
Create hunting rule
Author:andretavare5
Description:PrivateLoader pay-per-install malware
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:win_privateloader_w0
Create hunting rule
Author:andretavare5
Reference:https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/328440/

Comments