PrivateLoader: the loader of the prevalent ruzki PPI service

MITRE Techniques

• [T1102.001] Web Service: Dead Drop Resolver – The loader deobfuscates embedded URL(s) not controlled by the attacker to obtain dead drop resolvers (‘The malware deobfuscates one or several embedded URL(s) not controlled by the attacker (tactic of dead drop resolver).’)
• [T1001] Data Obfuscation – The loader uses stack string obfuscation and methods to conceal its operations (‘Stack string obfuscation; … Anti-analysis techniques.’)
• [T1105] Ingress Tool Transfer – The loader downloads the next payload over HTTPS and executes it (‘Next stage payload download over HTTPS and execution.’)
• [T1132] Data Encoding – C2 communications are encoded/obfuscated (e.g., XOR with a key) (‘The communication with PrivateLoader C2 is obfuscated xor the HTTP body with the key 0x6d.’)
• [T1568] Dynamic Resolution – The core module dynamically retrieves the next URL to load the subsequent stage payload (‘The Core module contacting the Command and Control (C2) to get the URL to download the next payload … subsequently used to get another URL hosting the next stage payload.’)
• [T1573.001] Encrypted Channel: Symmetric Cryptography – The C2 channel uses symmetric-like encryption (XOR) to conceal payload data (‘communication… obfuscated by XORing the HTTP body with the key 0x6d’).
• [T1027] Obfuscated Files or Information – The loader employs obfuscation (byte replacement table and deobfuscation process) to conceal payloads (‘Table 1 : Byte replacement table’ … deobfuscated payloads).
• [T1608.001] Stage Capabilities: Upload Malware – The core module can trigger loading of additional malware or end its activity depending on configuration (‘Core module allows two configurations, … the second configuration downloads other malwares and ends its activity’).