MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 469e2d368652b3fd0eac3dfb416cb617b5f5253c87e2a381805c64d1c04e9060. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PrivateLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 469e2d368652b3fd0eac3dfb416cb617b5f5253c87e2a381805c64d1c04e9060
SHA3-384 hash: 7e7b3758db07942d961c217872ece3e57ccd0aaf4f2c3296e3af68ca1504b92fdfe86e2288fc5d0c4d0d66075cabf767
SHA1 hash: 876492b2a0c678419ba77b31e018cbd6d3667f00
MD5 hash: 4431375d54f8f5f471a53feb343b3fff
humanhash: happy-uranus-california-blossom
File name:file
Download: download sample
Signature PrivateLoader
Create hunting rule
File size:2'225'664 bytes
First seen:2022-08-25 11:00:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 49152:P2gi1kUQA09YY3b5Qz8mxHmpmzMbEaUTI7DTK:01kNYYywmxvzoE1I7
Threatray 13'997 similar samples on MalwareBazaar
TLSH T198A5DFC34BA05C78E99885BC491D956781FC4A3E4068D8524B57FF830EC653EBE68A3F
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 80a4a4a4a4a4a480 (2 x CrimsonRAT, 1 x PrivateLoader)
Reporter andretavare5
Tags:exe PrivateLoader


Avatar
andretavare5
Sample downloaded from https://vk.com/doc746114588_646327298?hash=lTZOXtrfv2OCdMWBGQuICEvjwzEsUugKJvRruNKlJzX&dl=G42DMMJRGQ2TQOA:1661424589:9z9IoZq7tZmH0U90SCzUCI6AKcarboL2KATP8crlsqg&api=1&no_preview=1#kis

Intelligence

File Origin
# of uploads :
1
# of downloads :
345
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-08-25 11:05:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a1bb4b0d-47a5-47a7-a94d-56e30b24772b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
zgRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/301125/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.13437.12896.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the system32 subdirectories
Creating a file
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Reading critical registry keys
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a system process
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63075708393b1c8c4710f64c/reports/2e22acdf-7a2d-441e-bf67-27bbbea129f3/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Zapchast
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/df5b5a68-ade3-449e-9185-624b62b84ac0
Result
Threat name:
AsyncRAT, Clipboard Hijacker, PrivateLoa
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1057633
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
DLL side loading technique detected
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AsyncRAT
Yara detected Clipboard Hijacker
Yara detected Generic Downloader
Yara detected PrivateLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 690146 Sample: file Startdate: 25/08/2022 Architecture: WINDOWS Score: 100 55 vk.com 2->55 57 sun6-22.userapi.com 2->57 59 3 other IPs or domains 2->59 69 Malicious sample detected (through community Yara rule) 2->69 71 Antivirus detection for dropped file 2->71 73 Multi AV Scanner detection for dropped file 2->73 75 11 other signatures 2->75 8 file.exe 1 7 2->8         started        12 Sjjxcqi.exe 3 2->12         started        14 Sjjxcqi.exe 2 2->14         started        signatures3 process4 file5 41 C:\Users\user\AppData\Roaming\...\Sjjxcqi.exe, PE32 8->41 dropped 43 C:\Users\user\...\Sjjxcqi.exe:Zone.Identifier, ASCII 8->43 dropped 45 C:\Users\user\AppData\Local\...\file.exe.log, ASCII 8->45 dropped 91 Encrypted powershell cmdline option found 8->91 16 InstallUtil.exe 50 8->16         started        21 powershell.exe 18 8->21         started        93 Machine Learning detection for dropped file 12->93 signatures6 process7 dnsIp8 49 vk.com 93.186.225.194, 443, 49724, 49725 VKONTAKTE-SPB-AShttpvkcomRU Russian Federation 16->49 51 sun6-22.userapi.com 95.142.206.2, 443, 49728, 49751 VKONTAKTE-SPB-AShttpvkcomRU Russian Federation 16->51 53 4 other IPs or domains 16->53 33 C:\Users\user\AppData\Local\Temp\...\nss3.dll, PE32 16->33 dropped 35 C:\Users\user\AppData\Local\...\mozglue.dll, PE32 16->35 dropped 37 C:\Users\user\...\oUZvkrERH3wEAh3ej3s6.exe, MS-DOS 16->37 dropped 39 8 other files (3 malicious) 16->39 dropped 61 May check the online IP address of the machine 16->61 63 Tries to steal Mail credentials (via file / registry access) 16->63 65 Tries to harvest and steal browser information (history, passwords, etc) 16->65 67 DLL side loading technique detected 16->67 23 oUZvkrERH3wEAh3ej3s6.exe 16->23         started        26 iYfqQiuHkksmpkWSPQEp.exe 1 16->26         started        29 conhost.exe 16->29         started        31 conhost.exe 21->31         started        file9 signatures10 process11 file12 77 Antivirus detection for dropped file 23->77 79 Detected unpacking (changes PE section rights) 23->79 81 Query firmware table information (likely to detect VMs) 23->81 89 2 other signatures 23->89 47 C:\Users\user\AppData\Roaming\...\oobeldr.exe, MS-DOS 26->47 dropped 83 Multi AV Scanner detection for dropped file 26->83 85 Machine Learning detection for dropped file 26->85 87 Hides threads from debuggers 26->87 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/469e2d368652b3fd0eac3dfb416cb617b5f5253c87e2a381805c64d1c04e9060/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2022-08-25 11:01:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i2pc2nugkkz72dvmhx5uc3fwc627kjj4q7rkhamalrsndqcosbqa._file
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
0d0be8ecc5e7c7d3fb48665b5860aa8eb97d367f58af0de01e8bcff3861f4c52
PrivateLoader
1decb96425907cdf59a1cb7382c479b220792dcca81e77c58141b118153b5cbe
PrivateLoader
367f9b98835a1c98ee8542f2009ccb23b4ef42ff7117e5774968196cfb43ac3e
PrivateLoader
4a9579d10dc37c2010e162741e19938e25d10e90a3de0d7632504cb6b9ed13e2
PrivateLoader
b52165d1dff358f826708910f6b025e710bc1ba9c975597e38acdecc0b9eff28
PrivateLoader
b94115f5638021ccf653c3de4c947632560d95d967d64b7b84860e813a8f692a
PrivateLoader
c3c42af61eaeb76c2a3ea4712a4fda9d25e83e91f4fa2b5f1236c5d76688fc43
PrivateLoader
e0579dc3a1e48845194d9cd9415ae492d375fd59cea0e1adf21866afde152f89
PrivateLoader
ffc8f608eaae685aaac75daef134d536de17e3cecfcb259b645bf3479022bf62
PrivateLoader
+ 13'987 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/220825-m4j3sschd7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Unpacked files
SH256 hash:
c27380836837001b62e6d8fb9c19e6caccae339a78da74452699fc1570f96e09
MD5 hash:
1c2f0c1e88e919b8a795a3833e7b0e5b
SHA1 hash:
e9a2ae5d719b04fedf7ac2b6e471efcdaa0b5762
Link:
https://www.unpac.me/results/25f04eb3-2ada-41d9-bd17-2db2ba17c040/
SH256 hash:
96a1cd7b371484f8e939eb8f6281a700e01901ea70c44804d0212694e44e88ce
MD5 hash:
fc31d054acc8bb350c819fb307333583
SHA1 hash:
6c87dcdfb75f6023fc0397fccdb39c40054d5245
Link:
https://www.unpac.me/results/25f04eb3-2ada-41d9-bd17-2db2ba17c040/
SH256 hash:
469e2d368652b3fd0eac3dfb416cb617b5f5253c87e2a381805c64d1c04e9060
MD5 hash:
4431375d54f8f5f471a53feb343b3fff
SHA1 hash:
876492b2a0c678419ba77b31e018cbd6d3667f00
Link:
https://www.unpac.me/results/25f04eb3-2ada-41d9-bd17-2db2ba17c040/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/469e2d368652/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/469e2d368652b3fd0eac3dfb416cb617b5f5253c87e2a381805c64d1c04e9060

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:privateloader
Create hunting rule
Author:andre@tavares.re
Description:PrivateLoader pay-per-install malware
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_privateloader_w0
Create hunting rule
Author:andretavare5
Reference:https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/301125/

Comments