MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7acc9b90cf11c071880a627ef389107d55f2cbc845c52d5f265e5b2855d6a575. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PrivateLoader


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7acc9b90cf11c071880a627ef389107d55f2cbc845c52d5f265e5b2855d6a575
SHA3-384 hash: 061269cfaa4cbbb44c50b53d97967222e53c3c4900b6061f122c871d85f62724849157c9bad8d68e659b290322ae45d1
SHA1 hash: a575e56b486486fbb696df8f8b3403e6ec266344
MD5 hash: fc9eaee53296ad6fa5994952aa070110
humanhash: spring-michigan-green-hamper
File name:SecuriteInfo.com.Trojan.GenericKD.64662634.30711.13556
Download: download sample
Signature PrivateLoader
Create hunting rule
File size:4'038'920 bytes
First seen:2023-01-02 10:39:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a56f115ee5ef2625bd949acaeec66b76 (53 x Stealc, 47 x PureHVNC, 28 x RedLineStealer)
ssdeep 98304:FXePazT+6i8quQA7Yb+jWe4Cfrwq6l0D7PaidBZcFz+mpJu6J:FXOai8qREYbyhpjR6lSR26C3
Threatray 7'208 similar samples on MalwareBazaar
TLSH T1271633F75F61D250E80DB5B3424E622F5B2C6036F54052F9FACA60B73C8FAAB55241A3
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon d498b09c9998cccc (1 x PrivateLoader)
Reporter SecuriteInfoCom
Tags:exe PrivateLoader signed

Code Signing Certificate

Organisation:HDD Toshiba SATA-III 10Tb HDWG460EZSTA N300 (7200rpm) 2048Mb 2.5 Rtl
Issuer:HDD Toshiba SATA-III 10Tb HDWG460EZSTA N300 (7200rpm) 2048Mb 2.5 Rtl
Algorithm:sha1WithRSAEncryption
Valid from:2022-10-22T18:03:55Z
Valid to:2032-10-23T18:03:55Z
Serial number: 68aa0845fd86768b49854d38c8874ccc
Intelligence: 16 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 61f7108f73abea106b894c3e8326bc3280dc116f05e1a79ab2bf4500b9db2653
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://ternnonsdist.jugem.jp/?eid=201
Verdict:
Malicious activity
Analysis date:
2023-01-02 07:31:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/788b625e-6ba4-4de1-a6e3-8621462b84da

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.64662634.30711.13556.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/63b2b44b0e926711fd76544d/reports/a5ede856-a622-4a73-86bb-89d98eeb94ba/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/997256b6-8e80-4ab6-afa8-9b427d61f2f7
Result
Threat name:
Fabookie, PrivateLoader, RedLine, SmokeL
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1144120
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates HTML files with .exe extension (expired dropper behavior)
Creates processes via WMI
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Detected VMProtect packer
Disable Windows Defender real time protection (registry)
Disables Windows Defender (deletes autostart)
Downloads files with wrong headers with respect to MIME Content-Type
Drops PE files to the document folder of the user
Found C&C like URL pattern
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Modifies Group Policy settings
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Fabookie
Yara detected PrivateLoader
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Vidar stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 776850 Sample: SecuriteInfo.com.Trojan.Gen... Startdate: 02/01/2023 Architecture: WINDOWS Score: 100 109 Multi AV Scanner detection for domain / URL 2->109 111 Malicious sample detected (through community Yara rule) 2->111 113 Antivirus detection for URL or domain 2->113 115 27 other signatures 2->115 11 SecuriteInfo.com.Trojan.GenericKD.64662634.30711.13556.exe 3 2->11         started        15 ClipManager_Svc.exe 2->15         started        process3 file4 83 SecuriteInfo.com.T...30711.13556.exe.log, CSV 11->83 dropped 145 Query firmware table information (likely to detect VMs) 11->145 147 Writes to foreign memory regions 11->147 149 Hides threads from debuggers 11->149 151 2 other signatures 11->151 17 InstallUtil.exe 10 40 11->17         started        signatures5 process6 dnsIp7 85 208.67.104.60, 49702, 49744, 80 GRAYSON-COLLIN-COMMUNICATIONSUS United States 17->85 87 vk.com 87.240.132.67, 443, 49704, 49705 VKONTAKTE-SPB-AShttpvkcomRU Russian Federation 17->87 89 13 other IPs or domains 17->89 63 C:\Users\...\yn0x6JNdxVJBYUceVkXMuIeO.exe, PE32 17->63 dropped 65 C:\Users\...\mmlL1AWdxHn2bPmj1L18YltP.exe, PE32 17->65 dropped 67 C:\Users\...\hUp11XDH2fh9SKmYVzxDILXW.exe, PE32 17->67 dropped 69 13 other malicious files 17->69 dropped 117 May check the online IP address of the machine 17->117 119 Creates HTML files with .exe extension (expired dropper behavior) 17->119 121 Disables Windows Defender (deletes autostart) 17->121 123 2 other signatures 17->123 22 Fpbs6_0pakdR1geItE_xcrZ_.exe 17 17->22         started        27 7K_CR54rN40IXWjFHc7ujnXz.exe 18 17->27         started        29 hUp11XDH2fh9SKmYVzxDILXW.exe 17->29         started        31 6 other processes 17->31 file8 signatures9 process10 dnsIp11 95 telegram.org 22->95 105 2 other IPs or domains 22->105 73 C:\Users\...\c3PF8YKXWQy7km6FcyVNJxwC.exe, MS-DOS 22->73 dropped 75 C:\Users\user\AppData\Local\...\WW14[1].bmp, MS-DOS 22->75 dropped 77 C:\...\PowerControl_Svc.exe, MS-DOS 22->77 dropped 125 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 22->125 127 Query firmware table information (likely to detect VMs) 22->127 129 Hides threads from debuggers 22->129 131 Tries to detect sandboxes / dynamic malware analysis system (registry check) 22->131 97 t.me 149.154.167.99, 443, 49753, 49754 TELEGRAMRU United Kingdom 27->97 99 116.203.3.152, 49756, 80 HETZNER-ASDE Germany 27->99 133 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 27->133 135 Tries to harvest and steal browser information (history, passwords, etc) 27->135 137 Tries to steal Crypto Currency Wallets 27->137 139 Writes to foreign memory regions 29->139 141 Allocates memory in foreign processes 29->141 143 Injects a PE file into a foreign processes 29->143 33 conhost.exe 29->33         started        101 kokoko-24.online 31->101 103 45.10.52.33, 49746, 5900 MTW-ASRU Russian Federation 31->103 107 4 other IPs or domains 31->107 79 C:\Users\user\AppData\Local\Temp\yZLjVw.cpl, PE32 31->79 dropped 81 C:\...\ClipManager_Svc.exe, PE32 31->81 dropped 35 yn0x6JNdxVJBYUceVkXMuIeO.exe 31->35         started        39 control.exe 31->39         started        41 mmlL1AWdxHn2bPmj1L18YltP.exe 31->41         started        43 4 other processes 31->43 file12 signatures13 process14 dnsIp15 91 xv.yxzgamen.com 188.114.97.3, 443, 49748, 49752 CLOUDFLARENETUS European Union 35->91 71 C:\Users\user\AppData\Local\Temp\db.dll, PE32 35->71 dropped 45 conhost.exe 35->45         started        47 rundll32.exe 39->47         started        49 explorer.exe 41->49 injected 93 20.189.173.20 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 43->93 51 conhost.exe 43->51         started        53 conhost.exe 43->53         started        file16 process17 process18 55 rundll32.exe 47->55         started        57 ClipManager_Svc.exe 49->57         started        59 ClipManager_Svc.exe 49->59         started        process19 61 rundll32.exe 55->61         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7acc9b90cf11c071880a627ef389107d55f2cbc845c52d5f265e5b2855d6a575/
Threat name:
ByteCode-MSIL.Trojan.Vidar
Create hunting rule
Status:
Malicious
First seen:
2022-12-31 19:55:54 UTC
File Type:
PE+ (Exe)
Extracted files:
7
AV detection:
16 of 40 (40.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=plgjxegpchahdcakmj7phciqpvk7fs6iixcs2xzglznsqvowuv2q._file
Verdict:
malicious
Similar samples:
06ece311c226daf62863e5791def4efee02dacfeacc6b7635095d0a63b715a99
PrivateLoader
083842534185758ad03c0a124d2a0a629225d97f3e3c4776c1ff727adeaae4c6
PrivateLoader
296e195f7896d20af579930d9bc481bc9d651e79480399c071531417bfede4a7
PrivateLoader
77109a0bbb0d37926a327f63491d41be714c6fbed0a3ea4e5565e1349120d9a3
PrivateLoader
7e481ee40af6227bc65f7334cffa28ef661ab49cb800ce383aed1cec82515ae5
PrivateLoader
97df47266aba1d8e7c70c88c8bf0851a53579dfac7d2bb6545ca85e809bbf1c6
PrivateLoader
a1f85be67018434f06e910c13c4833aae7689793a7ce80a70ca5028877e9f40e
PrivateLoader
e3b0a6b1e8aa4cc6407d49b2bc8607549fc5b25cd2b11fc66a41127266c3ca47
PrivateLoader
eebeb8f37bef6e92068903c7a0dafa6a1a5f86f987ba1ad3336ccc855bfd317e
PrivateLoader
+ 7'198 additional samples on MalwareBazaar
Result
Malware family:
privateloader
Create hunting rule
Score:
  10/10
Tags:
family:privateloader evasion loader main themida trojan
Link:
https://tria.ge/reports/230102-mpymmshb21/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Looks up external IP address via web service
Checks BIOS information in registry
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
PrivateLoader
Malware Config
C2 Extraction:
http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
208.67.104.60
Unpacked files
SH256 hash:
7acc9b90cf11c071880a627ef389107d55f2cbc845c52d5f265e5b2855d6a575
MD5 hash:
fc9eaee53296ad6fa5994952aa070110
SHA1 hash:
a575e56b486486fbb696df8f8b3403e6ec266344
Link:
https://www.unpac.me/results/39b51dc9-2f9e-41b4-a771-d20325e51626/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7acc9b90cf11c071880a627ef389107d55f2cbc845c52d5f265e5b2855d6a575

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments