MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df331eba38f2b1e308c48f0e3b76a7a129a4e9195de29fb3b2c6ca9c81d56bbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PrivateLoader


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df331eba38f2b1e308c48f0e3b76a7a129a4e9195de29fb3b2c6ca9c81d56bbd
SHA3-384 hash: 10790dfda82725846893da79fdcb6bc0e6a0be42e8639c75198976a31031d03ce4978fed3d7f76d750404f65f8b973a9
SHA1 hash: 1875f69f4025ebbff2c55b7821cb8c32f5b6ec9d
MD5 hash: bcdbc45f525f35fcc51087be4a778e70
humanhash: spaghetti-apart-video-nuts
File name:file
Download: download sample
Signature PrivateLoader
Create hunting rule
File size:1'703'936 bytes
First seen:2022-08-25 14:33:24 UTC
Last seen:2022-08-25 16:32:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fb94954977c34d8bad8ff230f4ec17bc (2 x PrivateLoader)
ssdeep 49152:ucTaWP7mYY9wSCBqaEH72AE4btDm+B2srZk:uYaWbY9uBqFS+rZk
Threatray 14'018 similar samples on MalwareBazaar
TLSH T1A9753350B531C90CDA3435BA792702561F4B28F3D8900EFD78DBE3437AFA6A5486E762
TrID 52.9% (.EXE) Win32 Executable (generic) (4505/5/1)
23.5% (.EXE) Generic Win/DOS Executable (2002/3)
23.5% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 9141e52928c1c1f1 (1 x PrivateLoader, 1 x RaccoonStealer)
Reporter andretavare5
Tags:exe PrivateLoader


Avatar
andretavare5
Sample downloaded from https://down18.s3.amazonaws.com/E_kiskis.bmp

Intelligence

File Origin
# of uploads :
3
# of downloads :
352
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Suspicious activity
Analysis date:
2022-08-25 14:36:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9fb1c287-4dce-4940-9117-cd365cc549a0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/301192/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.1832.17.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
DNS request
Sending a custom TCP request
Creating a file
Creating a file in the %temp% directory
Reading critical registry keys
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Launching a process
Creating a file in the system32 subdirectories
Stealing user critical data
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/630788f93cbb13868a7fd669/reports/e6b682c1-b7eb-4a84-a701-71a05ef0e0e9/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d9418503-2ac4-424a-872e-8f3e4f905912
Result
Threat name:
Clipboard Hijacker, PrivateLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1057820
Signature
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Clipboard Hijacker
Yara detected PrivateLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 690335 Sample: file Startdate: 25/08/2022 Architecture: WINDOWS Score: 100 61 Malicious sample detected (through community Yara rule) 2->61 63 Antivirus detection for dropped file 2->63 65 Multi AV Scanner detection for dropped file 2->65 67 5 other signatures 2->67 8 file.exe 49 2->8         started        13 oobeldr.exe 2->13         started        process3 dnsIp4 41 vk.com 93.186.225.194, 443, 49720, 49721 VKONTAKTE-SPB-AShttpvkcomRU Russian Federation 8->41 43 sun6-22.userapi.com 95.142.206.2, 443, 49724 VKONTAKTE-SPB-AShttpvkcomRU Russian Federation 8->43 45 4 other IPs or domains 8->45 31 C:\Users\user\AppData\...\vcruntime140.dll, PE32 8->31 dropped 33 C:\Users\user\AppData\...\libcrypto-3.dll, PE32 8->33 dropped 35 C:\Users\user\...\CsFME_UjcaZrCqV_ZpJO.exe, MS-DOS 8->35 dropped 37 8 other files (3 malicious) 8->37 dropped 69 Detected unpacking (changes PE section rights) 8->69 71 Query firmware table information (likely to detect VMs) 8->71 73 May check the online IP address of the machine 8->73 83 4 other signatures 8->83 15 CsFME_UjcaZrCqV_ZpJO.exe 1 8->15         started        19 4DLqhL7Rp_Mr_ATFh8FO.exe 8->19         started        21 conhost.exe 8->21         started        75 Antivirus detection for dropped file 13->75 77 Multi AV Scanner detection for dropped file 13->77 79 Tries to detect sandboxes and other dynamic analysis tools (window names) 13->79 81 Machine Learning detection for dropped file 13->81 23 schtasks.exe 1 13->23         started        file5 signatures6 process7 file8 39 C:\Users\user\AppData\Roaming\...\oobeldr.exe, MS-DOS 15->39 dropped 47 Antivirus detection for dropped file 15->47 49 Multi AV Scanner detection for dropped file 15->49 51 Detected unpacking (changes PE section rights) 15->51 59 2 other signatures 15->59 25 schtasks.exe 1 15->25         started        53 Query firmware table information (likely to detect VMs) 19->53 55 Machine Learning detection for dropped file 19->55 57 Hides threads from debuggers 19->57 27 conhost.exe 23->27         started        signatures9 process10 process11 29 conhost.exe 25->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df331eba38f2b1e308c48f0e3b76a7a129a4e9195de29fb3b2c6ca9c81d56bbd/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-08-25 14:34:15 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
16 of 39 (41.03%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=34zr5ory6ky6gcger4hdw5vhueu2j2izlxrj7m5sy3fjzaovno6q._file
Verdict:
malicious
Similar samples:
0d0be8ecc5e7c7d3fb48665b5860aa8eb97d367f58af0de01e8bcff3861f4c52
PrivateLoader
1decb96425907cdf59a1cb7382c479b220792dcca81e77c58141b118153b5cbe
PrivateLoader
367f9b98835a1c98ee8542f2009ccb23b4ef42ff7117e5774968196cfb43ac3e
PrivateLoader
469e2d368652b3fd0eac3dfb416cb617b5f5253c87e2a381805c64d1c04e9060
PrivateLoader
4a9579d10dc37c2010e162741e19938e25d10e90a3de0d7632504cb6b9ed13e2
PrivateLoader
b52165d1dff358f826708910f6b025e710bc1ba9c975597e38acdecc0b9eff28
PrivateLoader
c3c42af61eaeb76c2a3ea4712a4fda9d25e83e91f4fa2b5f1236c5d76688fc43
PrivateLoader
e0579dc3a1e48845194d9cd9415ae492d375fd59cea0e1adf21866afde152f89
PrivateLoader
ffc8f608eaae685aaac75daef134d536de17e3cecfcb259b645bf3479022bf62
PrivateLoader
+ 14'008 additional samples on MalwareBazaar
Result
Malware family:
privateloader
Create hunting rule
Score:
  10/10
Tags:
family:privateloader evasion loader trojan
Link:
https://tria.ge/reports/220825-rxexqafbg8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks whether UAC is enabled
Looks up external IP address via web service
Checks BIOS information in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
PrivateLoader
Unpacked files
SH256 hash:
7aeb348a4b6ce55c8afed24e46cbe34fbfb70c3f9b80dabbe476d61a005184ce
MD5 hash:
9533a318ea5fec0720519e3d548f2978
SHA1 hash:
786c962c6d8ed5cd774028e3f458a9a084c156f8
Link:
https://www.unpac.me/results/5a2742f2-ffe5-482e-9b04-ac64ca7e3c6f/
SH256 hash:
df331eba38f2b1e308c48f0e3b76a7a129a4e9195de29fb3b2c6ca9c81d56bbd
MD5 hash:
bcdbc45f525f35fcc51087be4a778e70
SHA1 hash:
1875f69f4025ebbff2c55b7821cb8c32f5b6ec9d
Link:
https://www.unpac.me/results/5a2742f2-ffe5-482e-9b04-ac64ca7e3c6f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/df331eba38f2b1e308c48f0e3b76a7a129a4e9195de29fb3b2c6ca9c81d56bbd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/301192/

Comments