PrivateLoader: The loader of the prevalent ruzki PPI service

Sekoia's report analyzes PrivateLoader — a widely used modular downloader tied to the ruzki Pay-Per-Install (PPI) service — detailing its architecture, anti-analysis and dead-drop resolver techniques, C2 infrastructure, and the wide range of final payloads distributed (information stealers, ransomware, botnets, miners). The report includes observed active C2 IPs and URLs, deobfuscation logic and a Python extractor, IoCs (hashes, domains, endpoints), and evidence linking the loader to the ruzki operator through customer statistic URLs and forum/Telegram activity.