PrivateLoaderMalware
According to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server.From MISP Galaxy
Last reported 22 days ago, by Silent Push2 reports
ATT&CK techniques
6 of 45 · each with the sentence it comes from- T1005Data from Local System
“T1005 Data from Local System”
- T1007System Service Discovery
“T1007 System Service Discovery”
- T1012Query Registry
“T1012 Query Registry”
- T1014Rootkit
“T1014 Rootkit”
- T1020Automated Exfiltration
“T1020 Automated Exfiltration”
- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Residential Proxy Risk: The Employee Earns Pennies, The Buyer Gets The Router“Silent Push notes the Peer2Profit SDK spread through pay-per-install botnets including PrivateLoader, a pattern researchers flagged publicly in 2023.”
-
Package deal: Malware bundles causing disruption and damage across EMEA“By mid-summer 2022, in 70% of the cases analyzed by Group-IB, this payload was loaded along with RedLine Stealer and PrivateLoader.”
Indicators in its reports
named in the reports above- hxxps://digitalfitsoft[.]comin 1 report
- digitalfitsoft[.]comin 1 report
- hxxps://installmentloan7vrt[.]orgin 1 report
- installmentloan7vrt[.]orgin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.