{"id":45197,"date":"2022-02-08T10:00:02","date_gmt":"2022-02-08T10:00:02","guid":{"rendered":"http:\/\/e8a52e5e-a2af-427b-9635-0f577a91fb10"},"modified":"2022-02-08T10:00:02","modified_gmt":"2022-02-08T10:00:02","slug":"pay-to-play-privateloader-spreads-smokeloader-redline-vidar-malware","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/pay-to-play-privateloader-spreads-smokeloader-redline-vidar-malware\/","title":{"rendered":"Pay to play PrivateLoader spreads Smokeloader, Redline, Vidar malware"},"content":{"rendered":"

An examination of a pay-per-install loader has highlighted its place in the deployment of popular malware strains including Smokeloader and Vidar.<\/p>\n

On Tuesday, Intel 471 published a report<\/a> into PrivateLoader that examines cyberattacks making use of the loader since May 2021. The pay-per-install (PPI) malware service has been in the cybercrime field for a time, but it is not known who is behind the malware’s development.<\/p>\n

Loaders are used to deploy additional payloads on a target machine. PrivateLoader is a variant that is offered to criminal customers on an installation basis, in which payment is made based on how many victims they manage to secure.  <\/p>\n

PrivateLoader is controlled through a set of command-and-control (C2) servers and an administrator panel designed with AdminLTE 3. <\/p>\n

\"screenshot-2022-02-07-at-10-36-36.png\"<\/span>