MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a420a585210d7c1d6ca6f20d571e09e5c8bb03138777cac9a3ea28ddc3978d6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PrivateLoader

Vendor detections: 4

Intelligence 4 IOCs YARA 15 File information Comments

SHA256 hash:	a420a585210d7c1d6ca6f20d571e09e5c8bb03138777cac9a3ea28ddc3978d6b
SHA3-384 hash:	bf8168c56a71551ba72ffdf0e0d86134df69cc471dfad55cd93cf3f7e9c7a63fc618749b60ac37a350bb698987375b1f
SHA1 hash:	218ce743f7b4ac2ed46fb4a0efd09921ff925d9d
MD5 hash:	78d79a3b68c68222634ca7ba5ee7e719
humanhash:	utah-mockingbird-mockingbird-autumn
File name:	arch3289.7z
Download:	download sample
Signature	PrivateLoader Create hunting rule
File size:	8'243'937 bytes
First seen:	2025-04-10 10:50:13 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
Note:	This file is a password protected archive. The password is: 1234
ssdeep	196608:YDgbR2lSgzvmWkOtrmI/ooyYugKR5Y4iulf:egKHtixoJuHY4igf
TLSH	T1E98633F51D58F61D33B184E96819019E4EFB48B0710A089A0F77DB6E67731B26D2E32B
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	aachum
Tags:	7z file-pumped PrivateLoader pw-1234 sst-my

iamaachum

https://sst.my/storage/get432.7z

PrivateLoader C2:
62.133.61.172
185.143.223.148

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

File Archive Information

This file is a password protected archive. The password is: 1234

This file archive contains 8 file(s), sorted by their relevance:

File name:	wbemcore.dll
File size:	1'487'728 bytes
SHA256 hash:	355c5669fb70a936addfe7c53044d0b7c0055070b9d24d06a2c61e1558d11513
MD5 hash:	9ffd35b4b694acc08fa0f69dc7cb2da2
MIME type:	application/x-dosexec
Signature	PrivateLoader

File name:	CbsCore.dll
File size:	2'217'344 bytes
SHA256 hash:	88321f17cbba381019fbd44c7d822e6c160a08501b436756244960014d06c8f4
MD5 hash:	7c710fe0b519e7e4fed5da28493b76c3
MIME type:	application/x-dosexec
Signature	PrivateLoader

File name:	clr.dll
File size:	8'085'944 bytes
SHA256 hash:	831fbb6ae86c114b4b8ba6631c01d39fa84cce83d6f94e2a0d0bce2388806e24
MD5 hash:	5344de3956422e827f0254ce0f997f9b
MIME type:	application/x-dosexec
Signature	PrivateLoader

File name:	mscordacwks.dll
File size:	1'410'936 bytes
SHA256 hash:	133ede25f199de80ad751258c44639c95d08e899be25c458ec98e02428536889
MD5 hash:	d0ee513805aa4cc9ef6e9c6b27939035
MIME type:	application/x-dosexec
Signature	PrivateLoader

File name:	wcp.dll
File size:	3'205'504 bytes
SHA256 hash:	b1bb713f8dabcc297284149af7ca6f74a6c4c28503e9f9f0721303566ce2273d
MD5 hash:	de6c5dc9968e59957eade9e2244aebd8
MIME type:	application/x-dosexec
Signature	PrivateLoader

File name:	mscordbi.dll
File size:	1'189'288 bytes
SHA256 hash:	bc344d3d9040eed585f018b1adcd6e48e6db920d9126ec1de57fc6c42966bee0
MD5 hash:	34788a0f957cbe05499e6fa5da30a5a8
MIME type:	application/x-dosexec
Signature	PrivateLoader

File name:	updateagent.dll
File size:	2'137'424 bytes
SHA256 hash:	be6b3c5322ec78e60b7e703d792b3000cc80cd1f1ba48142589b2b273c2ce2e7
MD5 hash:	2421a8679d68e996e6a34f121cdcc3f2
MIME type:	application/x-dosexec
Signature	PrivateLoader

File name:	File.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	737'148'928 bytes
SHA256 hash:	90d96d622c5f3a352c449e9a562362c76f6f6d94805fb15a3dae9cca0ee620a2
MD5 hash:	4b558df274fdc72eff76717d337b5500
De-pumped file size:	3'015'680 bytes (Vs. original size of 737'148'928 bytes)
De-pumped SHA256 hash:	3bd05aa096c69b414698dcaa85732a24062f69297fb6417094cc6b879f8b3e75
De-pumped MD5 hash:	230897c2dd0b27c751a47a0c4c0d3377
MIME type:	application/x-dosexec
Signature	PrivateLoader

Vendor Threat Intelligence

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f7a7401dba888a93ceedd0

Tags:

injection dropper obfusc

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/a420a585210d7c1d6ca6f20d571e09e5c8bb03138777cac9a3ea28ddc3978d6b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a420a585210d7c1d6ca6f20d571e09e5c8bb03138777cac9a3ea28ddc3978d6b/

Threat name:

Binary.Trojan.Generic

Status:

Suspicious

First seen:

2024-09-01 19:06:20 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

5 of 38 (13.16%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uqqklbjbbv6b23fg6igvohqj4xelwaytq534vsnd5iun3q4xrvvq._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/250410-njy7nazths/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DotNet_Reactor Create hunting rule
Author:	@bartblaze
Description:	Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	PureCrypter Create hunting rule
Author:	@bartblaze
Description:	Identifies PureCrypter, .NET loader and obfuscator.
Reference:	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)