PrivateLoader: The first step in many malware schemes

Pay-per-install (PPI) malware services have been an integral part of the cybercrime ecosystem for a considerable amount of time. A malware operator provides payment, malicious payloads and targeting information, and those responsible for running the service outsource the distribution and delivery. The accessibility and moderate costs allow malware operators to leverage these services as another weapon for rapid, bulk and geo-targeted malware infections.

By understanding how these services proliferate, defenders can better recognize these campaigns and stop them from wreaking havoc on their organization’s IT stack. This report focuses on the PrivateLoader modular downloader programmed in the C++ programming language connected to an unidentified PPI service. PrivateLoader sits at the front of this operation and communicates with its back-end infrastructure to retrieve URLs for the malicious payloads to “install” on the infected host. As is the case with downloaders tied to PPI services, PrivateLoader communicates a variety of statistics such as which payloads were downloaded and launched successfully.

Distribution campaigns generally rely on a network of search engine optimization (SEO) enhanced websites that lure unsuspecting victims searching for warez aka pirated software to download and execute malware. A password-protected archive typically is delivered that contains a setup file that embeds and executes multiple malicious payloads on the infected host such as GCleaner, PrivateLoader, Raccoon, Redline, Smokeloader and Vidar malware. We assess these campaigns started to incorporate PrivateLoader since at least May 2021.

This report investigates the PPI service behind it and methods operators employ to obtain “installs” and presents details about the malware families the service delivers.

How PrivateLoader works

The service behind this PrivateLoader PPI campaign and its operators are unknown, as it was not possible to connect the downloader to a specific underground PPI service at the time of this report. However, we observed PrivateLoader’s main command and control (C2) servers also host the administration panel, which is based on the AdminLTE 3 dashboard template. The image below shows the authentication page:

The front-end script, which uses the Javascript library app.js, appears to expose functionalities offered to panel users. The table below describes interesting JavaScript functions in the script:

Delivering the PrivateLoader downloader

PrivateLoader is delivered through a network of websites that claim to provide “cracked” software, which is modified versions of popular legitimate applications that people commonly use. These websites are SEO optimized and usually appear at the top of search queries that contain keywords such as “crack” or “crack download,” preceded by the software name.

For example, a search for “Malwarebytes crack” returns the following websites as the fourth and fifth results:

Visitors are lured into clicking a “Download Crack” or “Download Now” button to obtain an allegedly cracked version of the software. The JavaScript for the download button is retrieved from a remote server.

After a few redirections, the final payload is served to the user as a password-protected compressed (.zip) archive. The screenshot below shows the actual download page:

In our example, the archive served was named “PASSWORD_IS_324325____Malwarebytes-Pr.zip.” It contained a Nullsoft Scriptable Install System (NSIS) installer named “setup_x86_x64_install.exe,” which embeds and executes numerous malicious payloads such as GCleaner, PrivateLoader and Redline.

Researchers from SophosLabs previously investigated this delivery network and tied some of its infrastructure to the InstallUSD PPI service.

Malware families dropped

Automated malware coverage and tracking for PrivateLoader started in early September 2021. We have since gathered sizable amounts of data that helped us learn more about the service.

The following chart shows the number of unique hashes downloaded by PrivateLoader for each malware family our Malware Intelligence systems detected. The most popular families this PPI service distributed in descending order were Smokeloader, Redline and Vidar:

Each PrivateLoader sample embeds a region code that is communicated to the C2 server and country of the bot. The chart below depicts the number of unique hashes downloaded per region code in the duration of coverage. We believe the “WW” prefix in these region codes stands for “worldwide,” since it was most commonly found in samples. On the panel side, we suspect this code represents the “link_geo” parameter described in the previous table.

However, we observe a different distribution when querying the number of unique hashes by bots’ country codes (see: chart below). This is expected since popular worldwide region codes encapsulate multiple countries.

Smokeloader

Of the payloads we saw pushed by PrivateLoader, the most common was Smokeloader. The following chart shows the extracted affiliate IDs (or lack thereof) from all unique Smokeloader samples detected by our Malware Intelligence systems:

The top 10 detected domains used to deliver Smokeloader included:

It’s apparent the operators running the “Privacy tools” domains heavily rely on PrivateLoader to deliver Smokeloader. An inspection of active distribution URLs showed these domains host a website that claims to offer “Privacy Tools.” This website likely is spoofing the real PrivacyTools[.]io website run by volunteers who advocate for data privacy.

These websites host Smokeloader payloads as part of three categories named “pab1”, “pab2” and “pab3”. These are not necessarily linked to the analogous “pub*” affiliate IDs, since we have seen some “pab2” payloads with the “555” affiliate ID. While tracking PrivateLoader, we only received links to download the “pab2” payloads from these websites. It is likely these operators use other methods or PPI services to distribute the Smokeloader family.

On Oct. 22, 2021, a “pab2” Smokeloader sample downloaded by PrivateLoader from one of these websites delivered the Qbot banking trojan. This is an unusual distribution method for Qbot and revealed the new botnet ID star01.

Banking trojans

There are other actors throughout the underground that leverage PrivateLoader for banking trojan distribution.

On Oct. 31, 2021, PrivateLoader bots connecting from European countries were instructed to download and execute the Kronos banking trojan from the following URL:

The downloaded sample also executed the Vidar information stealer. The download and execute commands for this sample stopped the following day.

On Nov. 1, 2021, PrivateLoader bots downloaded Dridex samples tied to the 10444 botnet, and Danabot with the affiliate identifier 40. The same day, bots also downloaded Trickbot samples with the group tags (gtags) lip*, tot* and top*. In all cases, the delivered samples embedded other malware families such as other banking trojans, information stealers or ransomware.

The sample with the hash 929a591331bdc1972357059d451a651d575166f676ea51daaeb358aa2a1064b7 that embedded both Dridex and Smokeloader was downloaded from the following URL:

hxxp://privacytoolzfor-you6000[.]top/downloads/toolspab2.exe

In the previous subsection, we linked the “Privacy tools” websites to Smokeloader operators. It is unclear whether the operators behind these websites operated the Dridex 10444 botnet or only acted as a link in the delivery chain. However, we can assume the “Privacy tools” website was used for distribution since the same Dridex botnet identifier and controllers were seen across different hashes and delivery URLs during this period.

Seeing downloads for Danabot, Dridex, Kronos and Trickbot for the first time within the same time frame hardly can be regarded as a coincidence. Moreover, these trojans often were bundled with each other. Therefore, we assess a single entity likely operating these specific botnets was using the PrivateLoader PPI service at the time.

On Nov. 14, 2021, PrivateLoader bots started to download samples of the Danabot banking trojan with the affiliate ID 4 for a single day.

Based on these short outbursts that lasted no more than a day, we suspect the banking trojan operators were experimenting with this PPI service as another delivery mechanism for their malware.

Ransomware

Underground PPI services generally advise against deploying ransomware on target machines since it renders them unusable. However, cybercriminals have a reputation of not adhering to rules and deploy ransomware anyway.

The only time in which we detected ransomware samples downloaded by PrivateLoader was when it dropped banking trojans in early November 2021. The table in the previous subsection showed downloads for the LockBit and STOP Djvu ransomware families.

While analyzing payloads downloaded by PrivateLoader, we identified a new loader we dubbed Discoloader. Discoloader was written using the .NET framework and uses the Discord content delivery network (CDN) to host its payload. Although not directly from PrivateLoader, we observed samples of this family delivering Conti ransomware directly into infected hosts, which is an uncharacteristic delivery mechanism since this family typically only is deployed after total compromise of enterprise networks.

Conclusion

PPI services have been a pillar of cybercrime for decades. Just like the wider population, criminals are going to flock to software that provides them a wide array of options to easily achieve their goals. As we have detailed, criminals have used PrivateLoader to launch all kinds of schemes. By highlighting the versatility of this malware, we hope to give defenders the chance to develop unique strategies in thwarting malware attacks empowered by PrivateLoader.

MITRE ATT&CK techniques

This report uses the MITRE Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) framework.