MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PrivateLoader


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e
SHA3-384 hash: 5f84dc886920ce5a36fb65fc770c6e54ae650f1aa755c1eee99d232ef9f1a0def0f4d4788706c88c20b1a819e4e832d4
SHA1 hash: 7d922b102a52241d28f1451d3542db12b0265b75
MD5 hash: 312ad3b67a1f3a75637ea9297df1cedb
humanhash: red-lithium-papa-mexico
File name:WW14.exe
Download: download sample
Signature PrivateLoader
Create hunting rule
File size:359'936 bytes
First seen:2022-09-02 12:54:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3c86c2b83b33b86ba24b34af43867478 (2 x PrivateLoader, 1 x RecordBreaker)
ssdeep 6144:N/qVYZEPD78jA9aNGY9i81SV2K2d6Or989IwfvyvbAxXUt:NeYZ+8d3S5yc
Threatray 456 similar samples on MalwareBazaar
TLSH T1DA74D655F5B181E5D87AE03595636A32BC797C984330DB8B97437B261F30BE0A63B702
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon e0e8ac989cd878e2 (2 x PrivateLoader)
Reporter JAMESWT_WT
Tags:exe PrivateLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
331
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
socelars
Create hunting rule
ID:
1
File name:
Setup.exe
Verdict:
Malicious activity
Analysis date:
2022-08-29 05:48:01 UTC
Tags:
opendir evasion trojan socelars stealer loader rat redline tofsee miner
Link:
https://app.any.run/tasks/03c0a472-b5fc-4b0c-8881-95fd275b76d0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/307428/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.34045.17922.25552.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
DNS request
Sending a custom TCP request
Reading critical registry keys
Sending an HTTP GET request
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% subdirectories
Creating a window
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Launching a process
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Searching for analyzing tools
Running batch commands
Launching cmd.exe command interpreter
Blocking the Windows Defender launch
Unauthorized injection to a recently created process
Launching a tool to kill processes
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware shell32.dll
Link:
https://www.filescan.io/uploads/6311fd6c116a699e0292f8e4/reports/78dbc2cd-d026-4c7d-b2ac-8fd79e4be473/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/709f5e9f-b19b-4472-a4fb-3e7e7495d569
Result
Threat name:
Nymaim, PrivateLoader, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1064072
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Creates an autostart registry key pointing to binary in C:\Windows
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Detected VMProtect packer
Disable Windows Defender real time protection (registry)
Drops PE files with benign system names
Found C&C like URL pattern
Found Tor onion address
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Modifies Group Policy settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Submitted sample is a known malware sample
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Nymaim
Yara detected PrivateLoader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 696595 Sample: WW14.exe Startdate: 02/09/2022 Architecture: WINDOWS Score: 100 105 www.hhiuew33.com 2->105 107 service-domain.xyz 2->107 109 6 other IPs or domains 2->109 129 Snort IDS alert for network traffic 2->129 131 Malicious sample detected (through community Yara rule) 2->131 133 Antivirus detection for URL or domain 2->133 135 23 other signatures 2->135 10 WW14.exe 5 43 2->10         started        15 svchost.exe 2->15         started        17 svchost.exe 3 2->17         started        19 11 other processes 2->19 signatures3 process4 dnsIp5 119 212.193.30.115, 49721, 49785, 80 SPD-NETTR Russian Federation 10->119 121 107.182.129.251, 49726, 80 META-ASUS Reserved 10->121 125 16 other IPs or domains 10->125 97 C:\Users\...\SccikCm8tan0f8f9fCWdaGBI.exe, PE32 10->97 dropped 99 C:\Users\...\P7CcT64RPKAchrVjWNuN_2En.exe, PE32+ 10->99 dropped 101 C:\Users\...\704sq4ABvcnopbIWm8FlwMj9.exe, PE32 10->101 dropped 103 11 other files (5 malicious) 10->103 dropped 161 May check the online IP address of the machine 10->161 163 Creates HTML files with .exe extension (expired dropper behavior) 10->163 165 Disable Windows Defender real time protection (registry) 10->165 21 PiX3MVEabBrFTpe7v9rMKiZO.exe 10->21         started        24 704sq4ABvcnopbIWm8FlwMj9.exe 10->24         started        28 i6VHx0ZCQlcCTvPsTfr9Ayet.exe 1 5 10->28         started        32 7 other processes 10->32 167 Changes security center settings (notifications, updates, antivirus, firewall) 15->167 30 MpCmdRun.exe 15->30         started        169 Query firmware table information (likely to detect VMs) 17->169 123 127.0.0.1 unknown unknown 19->123 file6 signatures7 process8 dnsIp9 89 C:\Users\user\AppData\Local\...\Install.exe, PE32 21->89 dropped 34 Install.exe 21->34         started        111 116.203.187.3, 14916, 49843 HETZNER-ASDE Germany 24->111 153 Query firmware table information (likely to detect VMs) 24->153 155 Hides threads from debuggers 24->155 157 Tries to detect sandboxes / dynamic malware analysis system (registry check) 24->157 38 cmd.exe 28->38         started        40 WerFault.exe 28->40         started        42 conhost.exe 30->42         started        113 ip-api.com 208.95.112.1, 49783, 80 TUT-ASUS United States 32->113 115 www.hhiuew33.com 45.136.151.102, 49786, 49788, 49790 ENZUINC-US Latvia 32->115 117 192.168.2.1 unknown unknown 32->117 91 C:\Users\user\AppData\Local\Temp\PcaGX.8, PE32 32->91 dropped 93 C:\Users\user\AppData\Local\...\is-N8Q7R.tmp, PE32 32->93 dropped 95 C:\Users\user\AppData\Local\...\System.exe, PE32+ 32->95 dropped 159 Tries to harvest and steal browser information (history, passwords, etc) 32->159 44 is-N8Q7R.tmp 32->44         started        46 SccikCm8tan0f8f9fCWdaGBI.exe 32->46         started        48 cmd.exe 32->48         started        50 3 other processes 32->50 file10 signatures11 process12 file13 73 C:\Users\user\AppData\Local\...\Install.exe, PE32 34->73 dropped 137 Multi AV Scanner detection for dropped file 34->137 52 Install.exe 34->52         started        139 Submitted sample is a known malware sample 38->139 141 Obfuscated command line found 38->141 56 cmd.exe 38->56         started        58 conhost.exe 38->58         started        75 C:\Program Files (x86)\...\ccsearcher.exe, PE32 44->75 dropped 77 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 44->77 dropped 79 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 44->79 dropped 83 4 other files (none is malicious) 44->83 dropped 60 ccsearcher.exe 44->60         started        81 C:\Windows\rss\csrss.exe, PE32 46->81 dropped 143 Creates an autostart registry key pointing to binary in C:\Windows 46->143 63 cmd.exe 48->63         started        65 conhost.exe 48->65         started        signatures14 process15 dnsIp16 85 C:\Users\user\AppData\Local\...\vyxpKiT.exe, PE32 52->85 dropped 87 C:\Windows\System32behaviorgraphroupPolicy\gpt.ini, ASCII 52->87 dropped 145 Antivirus detection for dropped file 52->145 147 Multi AV Scanner detection for dropped file 52->147 149 Modifies Group Policy settings 52->149 151 Obfuscated command line found 56->151 67 findstr.exe 56->67         started        127 208.67.104.97, 49798, 80 GRAYSON-COLLIN-COMMUNICATIONSUS United States 60->127 69 tasklist.exe 63->69         started        71 find.exe 63->71         started        file17 signatures18 process19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e/
Threat name:
Win32.Backdoor.Zapchast
Create hunting rule
Status:
Malicious
First seen:
2022-07-30 16:49:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hngb2cqrezuiola5j6oj25qipivp46ucqgtmw24xfsk7wl2owkha._file
Verdict:
malicious
Similar samples:
3f947f5a849f11be9079a5c2418240e2faf7e53b63662c85b92fad8f47ea4d09
PrivateLoader
595a5d21b386ba8e30b567cbe575b24ed104ee589037a48aa2d277452ba0b6a6
PrivateLoader
79352910f5e31ab1c843a5a7230d1f278dda20f721ad03243dd44f8d7806c2ed
PrivateLoader
b02e208c505340db8fa3ebd470bea3872bd2790443596a20f119a7667aab1af6
PrivateLoader
e8e4a4c7c5c593136058722cabe2d42631feffde95d923f5fd7020b0c7286f22
PrivateLoader
f072f7896731668ac389aa1d7da8c1d12a858bcf58b6ef8d023ffa78ef3f4023
PrivateLoader
f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b
PrivateLoader
+ 446 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:glupteba family:nymaim family:privateloader family:redline family:smokeloader botnet:2 backdoor discovery dropper evasion infostealer loader main persistence spyware stealer themida trojan vmprotect
Link:
https://tria.ge/reports/220902-p5r6xagee5/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Enumerates processes with tasklist
Enumerates system info in registry
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Launches sc.exe
Drops file in Program Files directory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Looks up external IP address via web service
Checks BIOS information in registry
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
VMProtect packed file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Detects Smokeloader packer
Glupteba
Modifies Windows Defender Real-time Protection settings
NyMaim
PrivateLoader
RedLine
RedLine payload
SmokeLoader
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
http://163.123.143.4/proxies.txt
http://107.182.129.251/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
163.123.143.12
http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
116.203.187.3:14916
Unpacked files
SH256 hash:
3b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e
MD5 hash:
312ad3b67a1f3a75637ea9297df1cedb
SHA1 hash:
7d922b102a52241d28f1451d3542db12b0265b75
Detections:
win_privateloader_a0
Create hunting rule
win_privateloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/1cc88013-411b-4fb0-b6cc-4a61c3d0db39/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3b4c1d0a1126/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:privateloader
Create hunting rule
Author:andretavare5
Description:PrivateLoader pay-per-install malware
Rule name:win_privateloader
Create hunting rule
Rule name:win_privateloader_w0
Create hunting rule
Author:andretavare5
Reference:https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PrivateLoader

Executable exe 3b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/307428/
  
URLhaus
https://urlhaus.abuse.ch/url/2265429/
  
Delivery method
Distributed via web download

Comments