Watch Out! Pay-Per-Install PrivateLoader Malware Distribution Service is Flourishing

PrivateLoader service users

• The accessibility and low costs of malware services such as PrivateLoader allow malware operators to use these services for fast and bulk geo-targeted infections.
• Other common payload families pushed by PrivateLoader include DanaBot, CryptBot, BitRAT, Remcos, LockBit, NanoCore, TrickBot, Kronos, NjRAT Agent Tesla, and Formbook.
• Additionally, it has been used to spread the Dridex botnet, Kronos banking trojan, and Discoloader - a loader malware used for spreading Conti ransomware.

Capabilities and offerings

• The administrative panel of the PPI service has various functions, such as adding new users, configuring a link for payload, modifying geolocation based on the campaign, and encrypting load files.
• The service obtains URLs for the malicious payloads deployed on the infected host.
• The distribution relies on a network of bait websites compromised to appear at the top in search results via SEO poisoning tactics targeting users seeking pirated software.

Conclusion