MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f705b9a3a34b5ee0096df7a9cb7ebc47b88df641662d0814613ad57c9389edd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PrivateLoader

Vendor detections: 13

Intelligence 13 IOCs YARA 7 File information Comments 1

SHA256 hash:	3f705b9a3a34b5ee0096df7a9cb7ebc47b88df641662d0814613ad57c9389edd
SHA3-384 hash:	172d392708919e4bc835d9a31b460dc05d65f74983be667a8583f75072b727667a84da56034aa9ff98d558cbe62c4335
SHA1 hash:	15b5e39e78affe52101082e9791fbe5d44b9adb1
MD5 hash:	1a2eababee42c294eed0e17642da1faa
humanhash:	tennessee-earth-july-butter
File name:	1a2eababee42c294eed0e17642da1faa
Download:	download sample
Signature	PrivateLoader Create hunting rule
File size:	1'404'928 bytes
First seen:	2023-09-18 09:34:14 UTC
Last seen:	2023-09-18 10:49:58 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b625b0422748e8ddd8a2e69ebe413b45 (6 x RisePro, 5 x RiseProStealer, 2 x PrivateLoader)
ssdeep	24576:bllUVTgNM3xzsQVwCfJIxc0foHid1GbagKEee/jC6Jp/HI7FmqdJB9j9Ji9GJehG:BlUVTgNM3xzsQVwCfJIx9foHid1GbagM
Threatray	3 similar samples on MalwareBazaar
TLSH	T1E5555AA1A302D0FFE05100B9766D66E6516A36F34F9258D7B3C05E6B14723EA6133F2B
TrID	40.3% (.EXE) Win64 Executable (generic) (10523/12/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4505/5/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	zbetcheckin
Tags:	32 exe PrivateLoader

Intelligence

File Origin

# of uploads :

# of downloads :

323

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

http://171.22.28.208/download/rise/StealerClient_Cpp1.exe

Verdict:

Malicious activity

Analysis date:

2023-09-18 10:37:38 UTC

Tags:

risepro

Link:

https://app.any.run/tasks/44065997-84e0-4dc5-8844-874969666d7e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/449313/

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.11472.18763.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a custom TCP request

Gathering data

Verdict:

No Threat

Threat level:

10/10

Confidence:

100%

Tags:

control crypto fingerprint greyware lolbin setupapi shell32

Link:

https://www.filescan.io/uploads/650819c832ffdb7a7a0a0423/reports/f0057209-9156-4837-b920-a22f5cd3f8bf/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/3f705b9a3a34b5ee0096df7a9cb7ebc47b88df641662d0814613ad57c9389edd

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ec75fc99-71ab-4726-a910-32d8262742ad

Result

Threat name:

PrivateLoader

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1309910

Signature

Antivirus / Scanner detection for submitted sample

Found potential dummy code loops (likely to delay analysis)

Found stalling execution ending in API Sleep call

Multi AV Scanner detection for submitted file

Opens the same file many times (likely Sandbox evasion)

Yara detected PrivateLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3f705b9a3a34b5ee0096df7a9cb7ebc47b88df641662d0814613ad57c9389edd/

Threat name:

Win32.Trojan.Privateloader

Status:

Suspicious

First seen:

2023-09-18 09:35:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

15 of 22 (68.18%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h5yfxgr2gs264aew355jzn7lyr5yrx3eczrnbakgcowvpsjyt3oq._file

Verdict:

malicious

PrivateLoader

71962e346aff1abde8b22e80fc99df7d7704b03dc5cad2c9404ee8df80619b5b

PrivateLoader

Result

Malware family:

privateloader

Score:

10/10

Tags:

family:privateloader

Link:

https://tria.ge/reports/230918-lkbrmsag76/

Unpacked files

SH256 hash:

3f705b9a3a34b5ee0096df7a9cb7ebc47b88df641662d0814613ad57c9389edd

MD5 hash:

1a2eababee42c294eed0e17642da1faa

SHA1 hash:

15b5e39e78affe52101082e9791fbe5d44b9adb1

Detections:

RiseProXorStr

win_privateloader_w0

win_privateloader_a0

Link:

https://www.unpac.me/results/0ddee41d-29b6-4de2-b511-cf1ef0730d6c/

Malware family:

PrivateLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3f705b9a3a34/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3f705b9a3a34b5ee0096df7a9cb7ebc47b88df641662d0814613ad57c9389edd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	privateloader Create hunting rule
Author:	andretavare5
Description:	PrivateLoader pay-per-install malware

Rule name:	win_privateloader Create hunting rule
Author:	andretavare5
Reference:	https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service

Rule name:	win_privateloader Create hunting rule

Rule name:	win_privateloader_w0 Create hunting rule
Author:	andretavare5
Reference:	https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service