MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 998e71ff054d133015a8d91c7ac23659560fe10ebef91e125d391400fa98e0f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PrivateLoader


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 998e71ff054d133015a8d91c7ac23659560fe10ebef91e125d391400fa98e0f9
SHA3-384 hash: 1ef23d417c70faf5a55819aabefdbd510c7e28ab568a648c11d8bde7e327c9acfea899ada4481ac0e8f212f184e2b998
SHA1 hash: f46197b44676e10e3d7c9556ad314d2a4783a1a3
MD5 hash: 5db4b27b42f92b6f42bbab7554899d84
humanhash: west-pip-yellow-asparagus
File name:file
Download: download sample
Signature PrivateLoader
Create hunting rule
File size:2'377'936 bytes
First seen:2022-11-08 12:47:56 UTC
Last seen:2022-11-09 12:13:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 53456c30898df524e8599bd8e4e68015 (1 x PrivateLoader)
ssdeep 49152:3F0LHkJkaCSW3OWHlGT+4ZxVvtCx2/aHllWpK2ILeUbnOwzJ1EEu:3F0DGCSW3Yl9vAgIDbnlEd
Threatray 2'802 similar samples on MalwareBazaar
TLSH T1DCB5239217688620E4B6C33379FD5215D7917C46B92ECD27B93E700BCA77AE0BA85343
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4505/5/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 30f08e8ecc8ecccc (1 x PrivateLoader)
Reporter andretavare5
Tags:exe PrivateLoader signed

Code Signing Certificate

Organisation:Acer Aspire C27-1655 DQ.BGHER.00S
Issuer:Acer Aspire C27-1655 DQ.BGHER.00S
Algorithm:sha1WithRSAEncryption
Valid from:2022-11-07T14:39:38Z
Valid to:2032-11-08T14:39:38Z
Serial number: 148c4d072570b98d4dfad9c3f385b521
Intelligence: 6 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 1c14973e2519b5266ceec9f7b8c5deaf812d5bfeb7e827509def7ab45a8f3725
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from https://vk.com/doc760750097_655631263?hash=9bLt520hgpqDWkTZXQZAmt1dAHSB1MEnB0izEDm8y8H&dl=G43DANZVGAYDSNY:1667910379:TykHJockNb1IsTXYxBZmVuhhEz3Bk0tW4YGIV6fe5eP&api=1&no_preview=1#CRYPO_ALL

Intelligence

File Origin
# of uploads :
859
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-08 12:49:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bfac05e6-df5b-4c7b-a150-eab6f1963a59

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/330519/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.4010.25427.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
Sending an HTTP GET request
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a file
Sending an HTTP POST request
Reading critical registry keys
Сreating synchronization primitives
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Launching a process
Creating a process with a hidden window
Creating a file in the %AppData% directory
Stealing user critical data
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/636a500438db7c2a0385ed5f/reports/9ca347a2-2299-419f-9f77-a127b7b2713b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/c5dc79e9-b2ac-4f4d-b210-a911eedadc73
Result
Threat name:
PrivateLoader
Create hunting rule
Detection:
malicious
Classification:
evad.troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1108762
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to detect virtual machines (IN, VMware)
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sets debug register (to hijack the execution of another thread)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Costura Assembly Loader
Yara detected PrivateLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 741426 Sample: file.exe Startdate: 09/11/2022 Architecture: WINDOWS Score: 100 35 Antivirus detection for URL or domain 2->35 37 Antivirus detection for dropped file 2->37 39 Multi AV Scanner detection for dropped file 2->39 41 6 other signatures 2->41 6 file.exe 54 2->6         started        process3 dnsIp4 29 vk.com 87.240.132.72, 443, 49711, 49712 VKONTAKTE-SPB-AShttpvkcomRU Russian Federation 6->29 31 sun9-77.userapi.com 87.240.169.0, 443, 49715 VKONTAKTE-SPB-AShttpvkcomRU Russian Federation 6->31 33 4 other IPs or domains 6->33 21 C:\Users\user\...\tq8laILl3GcQ07Z_5R20.exe, MS-DOS 6->21 dropped 23 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 6->23 dropped 25 C:\Users\user\AppData\Local\Temp\...\nss3.dll, PE32 6->25 dropped 27 10 other files (8 malicious) 6->27 dropped 43 Query firmware table information (likely to detect VMs) 6->43 45 May check the online IP address of the machine 6->45 47 Tries to detect sandboxes and other dynamic analysis tools (window names) 6->47 49 4 other signatures 6->49 11 Ya8_bNcPoczWUkAxrHEV.exe 3 6->11         started        14 OO180VBOi3oNRm8zXF4N.exe 3 6->14         started        16 tq8laILl3GcQ07Z_5R20.exe 2 6->16         started        file5 signatures6 process7 file8 51 Antivirus detection for dropped file 11->51 53 Multi AV Scanner detection for dropped file 11->53 55 Detected unpacking (changes PE section rights) 11->55 57 Sets debug register (to hijack the execution of another thread) 11->57 59 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->59 61 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 14->61 63 Contains functionality to detect virtual machines (IN, VMware) 14->63 19 C:\Users\user\...\tq8laILl3GcQ07Z_5R20.exe, MS-DOS 16->19 dropped 65 Tries to evade debugger and weak emulator (self modifying code) 16->65 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/998e71ff054d133015a8d91c7ac23659560fe10ebef91e125d391400fa98e0f9/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Suspicious
First seen:
2022-11-08 12:48:15 UTC
File Type:
PE (Exe)
Extracted files:
103
AV detection:
23 of 41 (56.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tghhd7yfjujtafni3eohvqrwlfla7yiox34r4es5hekab6uy4d4q._file
Verdict:
malicious
Similar samples:
0e63b13097c8e9ed9f0fe06c7972be1beb8890e6e7640584be1afd5740276307
PrivateLoader
3d538725fd27edb771e7e5c07a11508d7363dc6f0bdb438240bd34eae746aeed
PrivateLoader
681a23b3dea51aef6bc1f005a80ac66ea6493b2bbb301dc3553ddf4c27b75d26
PrivateLoader
68f180eba9b8ddb67c69b9e410835bd14e801e12127b5a56d3766843d6a71013
PrivateLoader
8ac674b46c91688deb492372c887161bd5367ab20f7d2faa25fbdce7be015f39
PrivateLoader
afa6e0b7cd564e4ce430f011a53baece9995952df817624643b95d6a0d9c08e5
PrivateLoader
e34e5d0bab748e72166ba8e74ef57acfda6a795bb95772139bd5c7a597ff4f6c
PrivateLoader
+ 2'792 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion themida trojan
Link:
https://tria.ge/reports/221108-p1r1cageh6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks whether UAC is enabled
Checks BIOS information in registry
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/add9bddb-8cff-404f-ad88-7f0307fce43d
Unpacked files
SH256 hash:
3e78a0dbbc8a6c0109eece95e910efe1dc5acdc5f506c1e22e03458219b27f7f
MD5 hash:
539322d59a97142d5c1cb6bb8f86b82e
SHA1 hash:
1d1ac9b3bd6ebcc367e2434f26347790941932c2
Link:
https://www.unpac.me/results/08eacaca-ef03-4bb5-b8f5-979099d511a3/
SH256 hash:
998e71ff054d133015a8d91c7ac23659560fe10ebef91e125d391400fa98e0f9
MD5 hash:
5db4b27b42f92b6f42bbab7554899d84
SHA1 hash:
f46197b44676e10e3d7c9556ad314d2a4783a1a3
Link:
https://www.unpac.me/results/08eacaca-ef03-4bb5-b8f5-979099d511a3/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/330519/

Comments