MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc84c3a9cfeb083fe41a238c55ea3163b5c9e5103fee0a7d7f4d8a1236b6d22d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PrivateLoader

Vendor detections: 12

Intelligence 12 IOCs YARA 10 File information Comments 1

SHA256 hash:	bc84c3a9cfeb083fe41a238c55ea3163b5c9e5103fee0a7d7f4d8a1236b6d22d
SHA3-384 hash:	216e50367578d15e1b198220672a8ab98ce8ce2289cec1d6200e9f9d6b096db86d7702213273ff403fa0e3c66a374f43
SHA1 hash:	0f905a137b801a69cf498fc0f8c5f00e75c5e689
MD5 hash:	5c0d04ccd0cbcd8cc90a502df8b512e7
humanhash:	failed-romeo-dakota-stream
File name:	5c0d04ccd0cbcd8cc90a502df8b512e7
Download:	download sample
Signature	PrivateLoader Create hunting rule
File size:	3'302'400 bytes
First seen:	2024-04-12 07:13:21 UTC
Last seen:	2024-04-12 07:28:05 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	dde04a4a91a59ef24083f245b804ae7b (2 x PrivateLoader)
ssdeep	49152:fEOGfMr0UrM21zm6mVonU7JCGjh9FDrjop1jy50JtrD2sGxgLJ+r8+NSR63xrO0s:rtr0CnnGJCGl9GDnrNGaLJ5RKxy
TLSH	T12FE53308FCABA195C1E90AF0C58E8E795372EE0C5DEF6058BA1D89DC597CECE714D122
TrID	50.0% (.EXE) Generic Win/DOS Executable (2002/3) 49.9% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):
dhash icon	fcccd0f0d0ccc4e4 (1 x RiseProStealer, 1 x PrivateLoader)
Reporter	zbetcheckin
Tags:	64 exe PrivateLoader

Intelligence

File Origin

# of uploads :

# of downloads :

361

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Searching for analyzing tools

Сreating synchronization primitives

Modifying a system file

Connection attempt

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

DNS request

Sending a custom TCP request

Replacing files

Launching a service

Launching a process

Reading critical registry keys

Sending a UDP request

Forced system process termination

Blocking the Windows Defender launch

Adding exclusions to Windows Defender

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

epmpress lolbin mpress packed packed packed shell32

Link:

https://www.filescan.io/uploads/6618df3b0b46b303693358dd/reports/f3125a54-faa6-4e28-beed-010b6bd25fb5/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/bc84c3a9cfeb083fe41a238c55ea3163b5c9e5103fee0a7d7f4d8a1236b6d22d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/f009021a-10ad-4351-a116-1d252ce37238

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1424936

Signature

Adds extensions / path to Windows Defender exclusion list (Registry)

Antivirus detection for dropped file

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Disable Windows Defender real time protection (registry)

Disables Windows Defender (deletes autostart)

Drops PE files to the document folder of the user

Exclude list of file types from scheduled, custom, and real-time scanning

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

Machine Learning detection for dropped file

Modifies Group Policy settings

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Snort IDS alert for network traffic

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Behaviour

Behavior Graph:

Download SVG

Score:

81%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bc84c3a9cfeb083fe41a238c55ea3163b5c9e5103fee0a7d7f4d8a1236b6d22d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bc84c3a9cfeb083fe41a238c55ea3163b5c9e5103fee0a7d7f4d8a1236b6d22d/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2024-04-11 15:45:05 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

11 of 24 (45.83%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xscmhkop5med7za2eogfl2rrmo24tziqh7xau7l7jwfbenvw2iwq._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

10/10

Tags:

evasion trojan

Link:

https://tria.ge/reports/240412-h2mzfsbg21/

Behaviour

Modifies system certificate store

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Looks up external IP address via web service

Checks BIOS information in registry

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Modifies firewall policy service

Unpacked files

SH256 hash:

bc84c3a9cfeb083fe41a238c55ea3163b5c9e5103fee0a7d7f4d8a1236b6d22d

MD5 hash:

5c0d04ccd0cbcd8cc90a502df8b512e7

SHA1 hash:

0f905a137b801a69cf498fc0f8c5f00e75c5e689

Detections:

INDICATOR_EXE_Packed_MPress

Link:

https://www.unpac.me/results/23a6be09-df4b-4c3e-9b24-079286dae8e8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bc84c3a9cfeb083fe41a238c55ea3163b5c9e5103fee0a7d7f4d8a1236b6d22d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_EXE_Packed_MPress Create hunting rule
Author:	ditekSHen
Description:	Detects executables built or packed with MPress PE compressor

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	mpress_2_xx_x64 Create hunting rule
Author:	Kevin Falcoz
Description:	MPRESS v2.XX x64 - no .NET

Rule name:	privateloader Create hunting rule
Author:	andretavare5
Description:	Detects PrivateLoader malware.

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	TeslaCryptPackedMalware Create hunting rule

Rule name:	win_privateloader Create hunting rule
Author:	andretavare5
Description:	Detects PrivateLoader malware.
Reference:	https://www.bitsight.com/blog/hunting-privateloader-malware-behind-installskey-ppi-service

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PrivateLoader

exe bc84c3a9cfeb083fe41a238c55ea3163b5c9e5103fee0a7d7f4d8a1236b6d22d

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2809865/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-04-12 07:13:22 UTC

url : hxxp://193.233.132.175/server/ww15/AppGate2103v15.exe