Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1076344" data-attributes="member: 32260">WHHLight vs. PrivateLoaderPrivateLoader is an example of Pay-Per-Install (PPI) malware service. In some campaigns it is used as initial malware, in others it is delivered as a payload.[URL unfurl=&quot;true&quot;]https://brandefense.io/blog/ransomware/privateloader-as-a-riseprostealer-dropper-technical-analysis/[/URL]The hashes of PrivateLoader samples can be found in some articles and known malware repositories:[URL unfurl=&quot;false&quot;]https://www.bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey[/URL][URL unfurl=&quot;false&quot;]https://1275.ru/ioc/683/privateloader-iocs/[/URL]An example of a simple attack flow:[URL unfurl=&quot;false&quot;]https://brandefense.io/blog/ransomware/privateloader-as-a-riseprostealer-dropper-technical-analysis/[/URL][ATTACH=full]281680[/ATTACH]A complex attack flow (Glupteba campaign):[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/glupteba-botnet-evades-detection-with-undocumented-uefi-bootkit.128984/post-1075238[/URL][URL unfurl=&quot;false&quot;]https://thehackernews.com/2024/02/glupteba-botnet-evades-detection-with.html[/URL][ATTACH=full]281681[/ATTACH]I analyzed over three hundred PrivateLoader samples. Almost all samples were unsigned or signed with fake certificates (blocked by SmartScreen). One old sample (from the year 2021) is allowed by SmartScreen (probably an adware downloader):[URL unfurl=&quot;false&quot;]https://www.virustotal.com/gui/file/29b49a8dab2aa6da9c1b7e4658b4f778ed0deec5ce48808826ae2210b846398a/detection[/URL]The results are similar to the results of GuLoader noted in my previous post:[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/whhlight-simplified-application-control-for-windows-home-and-pro.128274/post-1075857[/URL]Edit.A few interesting articles related to PrivateLoader:[URL unfurl=&quot;false&quot;]https://www.esentire.com/blog/fake-browser-updates-distribute-lummac-stealer-amadey-and-privateloader-malware[/URL][URL unfurl=&quot;false&quot;]https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/[/URL][URL unfurl=&quot;false&quot;]https://blog.sekoia.io/new-risepro-stealer-distributed-by-the-prominent-privateloader/[/URL][URL unfurl=&quot;false&quot;]https://flashpoint.io/blog/risepro-stealer-and-pay-per-install-malware-privateloader/[/URL][URL unfurl=&quot;false&quot;]https://intel471.com/blog/privateloader-malware[/URL][URL unfurl=&quot;false&quot;]https://de.darktrace.com/blog/privateloader-network-based-indicators-of-compromise[/URL]</blockquote>

[QUOTE="Andy Ful, post: 1076344, member: 32260"] [B][SIZE=5]WHHLight vs. PrivateLoader[/SIZE][/B] PrivateLoader is an example of Pay-Per-Install (PPI) malware service. In some campaigns it is used as initial malware, in others it is delivered as a payload. [URL unfurl="true"]https://brandefense.io/blog/ransomware/privateloader-as-a-riseprostealer-dropper-technical-analysis/[/URL] The hashes of PrivateLoader samples can be found in some articles and known malware repositories: [URL unfurl="false"]https://www.bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey[/URL] [URL unfurl="false"]https://1275.ru/ioc/683/privateloader-iocs/[/URL] An example of a simple attack flow: [URL unfurl="false"]https://brandefense.io/blog/ransomware/privateloader-as-a-riseprostealer-dropper-technical-analysis/[/URL] [ATTACH type="full" alt="1708600092819.png"]281680[/ATTACH] A complex attack flow (Glupteba campaign): [URL unfurl="false"]https://malwaretips.com/threads/glupteba-botnet-evades-detection-with-undocumented-uefi-bootkit.128984/post-1075238[/URL] [URL unfurl="false"]https://thehackernews.com/2024/02/glupteba-botnet-evades-detection-with.html[/URL] [ATTACH type="full" alt="1708600268848.png"]281681[/ATTACH] I analyzed over three hundred PrivateLoader samples. Almost all samples were unsigned or signed with fake certificates (blocked by SmartScreen). One old sample (from the year 2021) is allowed by SmartScreen (probably an adware downloader): [URL unfurl="false"]https://www.virustotal.com/gui/file/29b49a8dab2aa6da9c1b7e4658b4f778ed0deec5ce48808826ae2210b846398a/detection[/URL] The results are similar to the results of GuLoader noted in my previous post: [URL unfurl="false"]https://malwaretips.com/threads/whhlight-simplified-application-control-for-windows-home-and-pro.128274/post-1075857[/URL] Edit. A few interesting articles related to PrivateLoader: [URL unfurl="false"]https://www.esentire.com/blog/fake-browser-updates-distribute-lummac-stealer-amadey-and-privateloader-malware[/URL] [URL unfurl="false"]https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/[/URL] [URL unfurl="false"]https://blog.sekoia.io/new-risepro-stealer-distributed-by-the-prominent-privateloader/[/URL] [URL unfurl="false"]https://flashpoint.io/blog/risepro-stealer-and-pay-per-install-malware-privateloader/[/URL] [URL unfurl="false"]https://intel471.com/blog/privateloader-malware[/URL] [URL unfurl="false"]https://de.darktrace.com/blog/privateloader-network-based-indicators-of-compromise[/URL] [/QUOTE]

Verification