PrivateLoader
- First seen
- 2021-09-01 00:00:00
- Malware type
- loader, downloader
- Family
- Malware family
- Last IoC activity
- 2026-07-22 01:37:29
- Profile updated
- 2026-07-07 13:46:40
Context
According to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server.
Detection coverage
- 2 YARA rules
Detection rules
- CAPE_Privateloader (yara-rule)
- MALPEDIA_Win_Privateloader_Auto (yara-rule)
Reports & references
- intel471.com — Privateloader Malware (report)
- blog.sekoia.io — Privateloader The Loader Of The Prevalent Ruzki Ppi Service (report)
- bitsight.com — Unveiling Socks5Systemz Rise New Proxy Service Privateloader And Amadey (report)
- any.run — Crackedcantil Breakdown (report)
- bitsight.com — Unveiling Socks5Systemz Rise New Proxy Service Privateloader And Amadey (report)
- medium.com — Privateloader To Anubis Loader 55D066A2653E (report)
- Kaspersky — 107498 (report)
- bitsight.com — Unpacking Colibri Loader Russian Apt Linked Campaign (report)
- intrinsec.com — Tlp Clear Cryptbot Hunting For Intial Access Vectors (report)
- medium.com — Icedid Leverages Privateloader 7744771Bf87F (report)
- blog.sekoia.io — Traffers A Deep Dive Into The Information Stealer Ecosystem (report)
- Trend Micro — Netdooka Framework Distributed Via Privateloader Ppi (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Privateloader (report)
- tavares.re — Hunting Privateloader Pay Per Install Service (report)
- de.darktrace.com — Privateloader Network Based Indicators Of Compromise (report)
- bitsight.com — Tracking Privateloader Malware Distribution Service (report)
- github.com — Privateloader (report)
- bitsight.com — Hunting Privateloader Malware Behind Installskey Ppi Service (report)
- embee-research.ghost.io — Identifying Privateloader Servers With Censys (report)
- youtube.com — Watch (report)
- zscaler.com — Peeking Privateloader (report)
- bitsight.com — Zero 50K Infections Pseudomanuscrypt Sinkholing Part 1 (report)
- any.run — Privateloader Analyzing The Encryption And Decryption Of A Modern Loader (report)