MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7c946e7e2af02c688453f19c952b316dd3f3ce37ffca1efb041a7265137d0f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PrivateLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7c946e7e2af02c688453f19c952b316dd3f3ce37ffca1efb041a7265137d0f9
SHA3-384 hash: 2c3d6f4c0ecc624e41e1f2eef5c394cd90d6368c929fd6df1afd871dd33f7f2b336ef6888a8840c01c56150d4cf18106
SHA1 hash: d74d03ce0717961c476743832715bb1d7fd3c7eb
MD5 hash: 37add18d94dbd7e36190ea036f17af50
humanhash: early-stream-virginia-enemy
File name:file
Download: download sample
Signature PrivateLoader
Create hunting rule
File size:5'615'632 bytes
First seen:2022-11-04 09:54:31 UTC
Last seen:2022-11-04 09:58:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 393e871a90ede3ce2376856602e1a430 (1 x PrivateLoader)
ssdeep 98304:Nv4FpBaXxCoqdXG3TNwrP/THgn95d4gPzd+aaqor+lkngIx0fMbtqNwW92ugPI9i:R4jkXYFXaNwrP/7g95d4gPzIaO4kSNwt
Threatray 1'019 similar samples on MalwareBazaar
TLSH T13D4633A669E48CF5F033E4BDAD8B3DB15B75A15D4880E920B81F7A227B9304D4FB1316
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4505/5/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 7872e4dcc4d8b1e1 (1 x PrivateLoader)
Reporter andretavare5
Tags:exe PrivateLoader


Avatar
andretavare5
Sample downloaded from https://vk.com/doc759438714_648915601?hash=svL2qoljexKcOtGY8X20z0ZrKZhq64wfcytCo5tZeCk&dl=G42TSNBTHA3TCNA:1667555369:I8Ga5dEQ2xmJr0FIPFG8ag0amCszZJJQ97OzEtfRABo&api=1&no_preview=1

Intelligence

File Origin
# of uploads :
3
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-04 09:55:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8d2d4736-6616-4a84-b7ce-f0693977a307

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/328412/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.31364.6297.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
Creating a file in the %temp% subdirectories
DNS request
Sending a custom TCP request
Sending an HTTP POST request
Reading critical registry keys
Creating a window
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed setupapi.dll shell32.dll
Link:
https://www.filescan.io/uploads/6364e178ec1c71bdbe75fe4c/reports/c082a1b1-8fe5-49cf-b6b4-0e06240f3395/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3f2b1bae-e3ca-4eb5-8009-3c1fdd67c638
Result
Threat name:
PrivateLoader, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1105293
Signature
Antivirus detection for URL or domain
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected PrivateLoader
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7c946e7e2af02c688453f19c952b316dd3f3ce37ffca1efb041a7265137d0f9/
Threat name:
Win32.Infostealer.PrivateJoker
Create hunting rule
Status:
Malicious
First seen:
2022-11-04 09:55:17 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
13 of 26 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=27eunz7cv4bmnccfh4m4suvtc3ot6phdp76kd35qigtsmujx2d4q._file
Verdict:
malicious
Similar samples:
14d0d52dd45d53a49f1bc88baebf0b5cfd60b269b5db56942d08264224061db7
PrivateLoader
4113658f7e5b8753968ecedd2715a44c01c9151d79186b446ea1a6b19245f401
PrivateLoader
469e2d368652b3fd0eac3dfb416cb617b5f5253c87e2a381805c64d1c04e9060
PrivateLoader
534d2cccb4e3f59faffe9ebcbf20af820ec5ab0cd5f5b1a30173e2d0b017d5c9
PrivateLoader
abb923c865ae7938904297d9ff4001af912b4d6903bc318a57b91d025404ad3d
PrivateLoader
df331eba38f2b1e308c48f0e3b76a7a129a4e9195de29fb3b2c6ca9c81d56bbd
PrivateLoader
ffc8f608eaae685aaac75daef134d536de17e3cecfcb259b645bf3479022bf62
PrivateLoader
+ 1'009 additional samples on MalwareBazaar
Result
Malware family:
privateloader
Create hunting rule
Score:
  10/10
Tags:
family:privateloader discovery evasion loader spyware stealer themida trojan
Link:
https://tria.ge/reports/221104-lxr96agbdq/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks installed software on the system
Checks whether UAC is enabled
Looks up external IP address via web service
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
PrivateLoader
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/cfd905d7-fbc6-4dbc-93ac-dcbadcebc815
Unpacked files
SH256 hash:
692effa4b075b4ac1a4325352bef2d1ca6db9d69625dbdabd49dbcf234088f25
MD5 hash:
a38f098fe399753fa12f7ec721de94aa
SHA1 hash:
cd94dec4b4be4492712928cc215b9fedf38939a7
Link:
https://www.unpac.me/results/4ec5f03d-b9b8-4a05-b5f0-bbb75ea1cffd/
SH256 hash:
656fbba8ab64cb634402dc20c5c952d5c0f73d127341af1d10603d534382fde4
MD5 hash:
4b2ac287eca8122653ba72fcc30f5e89
SHA1 hash:
885fbb8e8f00556771f86e6bff78b86d5476e09b
Link:
https://www.unpac.me/results/4ec5f03d-b9b8-4a05-b5f0-bbb75ea1cffd/
SH256 hash:
c1dcc4430a0273b45b3447e3010268e51e2c99924d045adc063812551e35f396
MD5 hash:
d46e095be89c714e68fe5f891654fb27
SHA1 hash:
84ed7473f661e9c81edd16762dc3a2ddda3cff3b
Link:
https://www.unpac.me/results/4ec5f03d-b9b8-4a05-b5f0-bbb75ea1cffd/
SH256 hash:
588c32b6a3568b6b7704625fa53331fff623479536bb553ff0f08a5acf738ab3
MD5 hash:
0dcce2c7cc28d875e303816a71fb1343
SHA1 hash:
6dfd73742925b844b3984ddc0657cfc3de956e0c
Link:
https://www.unpac.me/results/4ec5f03d-b9b8-4a05-b5f0-bbb75ea1cffd/
SH256 hash:
aeaaa4cb4915a537e5841f175302bee0c5a83f812c41eeea2665f963a5189ee4
MD5 hash:
a4b6b177d7e3dafaed7c39b8e320f1ea
SHA1 hash:
56fb42535d1efd11febe21f859c992e3e3faafdb
Link:
https://www.unpac.me/results/4ec5f03d-b9b8-4a05-b5f0-bbb75ea1cffd/
SH256 hash:
87eda04a67ca4dfee714d1f66fd55461674f44c067213283e4752e27a7a93fb6
MD5 hash:
31e82aad5c10f8dcd8c0b8ec1e471108
SHA1 hash:
51745e58ad3e26838b92883968a135cb7e3db86d
Link:
https://www.unpac.me/results/4ec5f03d-b9b8-4a05-b5f0-bbb75ea1cffd/
SH256 hash:
98196bd80c1a00645bcd331c25e5d09386ea4c00682548c57327c4c2f1c4ed67
MD5 hash:
e6450e61e2d9a885e1dd38d033b8b6b4
SHA1 hash:
012c9a353414764c39f6cbc68d9125d11622e44f
Link:
https://www.unpac.me/results/4ec5f03d-b9b8-4a05-b5f0-bbb75ea1cffd/
SH256 hash:
3201c84e74295ab29d0cd1a42477d89bc096262bacd05e5e6bbe681196839c7c
MD5 hash:
dac1afacb33c6bca1eff7fd076a6fd35
SHA1 hash:
b4763122ab3835c182837edab1b741276bc1d146
Detections:
PrivateLoader
Create hunting rule
win_privateloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/4ec5f03d-b9b8-4a05-b5f0-bbb75ea1cffd/
SH256 hash:
d7c946e7e2af02c688453f19c952b316dd3f3ce37ffca1efb041a7265137d0f9
MD5 hash:
37add18d94dbd7e36190ea036f17af50
SHA1 hash:
d74d03ce0717961c476743832715bb1d7fd3c7eb
Link:
https://www.unpac.me/results/4ec5f03d-b9b8-4a05-b5f0-bbb75ea1cffd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/d7c946e7e2af02c688453f19c952b316dd3f3ce37ffca1efb041a7265137d0f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:privateloader
Create hunting rule
Author:andretavare5
Description:PrivateLoader pay-per-install malware
Rule name:win_privateloader_w0
Create hunting rule
Author:andretavare5
Reference:https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/328412/

Comments