+H�F*GgN7D�ޙ�/���T!�Q�ʷ-2M�+�mM۳!% �w���?Ld�|5�HE(���`!�"Q�.����=c#3���;$���-�k�K.fou���p ^��g���9��9e�i���@�'N �]�s�8��}��(�ɕ�m}�`y�h��@1�x���d����C��-��Ju������ӍQ�r�w�0�N��ώ��7 }L��w���?��u�{,� �jT��<�d}l�Ge�����PkC�"�:�i�_��%�!�$��#fV*)��|�] $Tθ+/s�x�^VH@��(��e��]���4�L6Y���Y���Z~��k뫘1=���:�?:&!� Cگ���x��X��$��Y�iΉw�#vn�� :��S{��p_�I�(0̪��c����g{#�rX���j�T���O:X/�[W�VOs���Vc|�C�D��'X�qŵ��2�x:��f�ة��}��;"F��$���N���M��2LJ�EG�����cb�>�R��-���W� �u!&��mX���6G���3!�Cj�?,���lb��ΒP��s���������ˎP��+%��*��Ho���"aZ���(���>I+�k��n�$�8��ںG��;��2뺊�#jVS���8����^%m�V��K%"Yn�تXg2�����w���Ú�?����Wg7�(C��i�v�8(9\ʘbl�2$�_5zh� �t!m��u=?h��)�aE�o�����ً����8=���lxot�|a��U9f�ݔ^� �{ν ��xm���W6r~��x��Z=S2�݅?y\�fϨ�)*0�3[hx�����0c��<[�pN���D��SC�=�ŕ�ʨe0�����H�¬Z`��-%�ynT��E�f���X���f� ]�m�!�F!g�����<����!q`����4����5g��í��U%II1]���%9հ�WG��VI��P{�&��5��/���@��ӌ�*`�����5����-���_&M/j�����T�b� ;0�k|d� d/X:ʕ���6Y��[��@��U�%u.�W��C����n �JLv��~z�Mj�����KK`���������%�c�qč� �X�PW��r ���+��7*k�Oˡz��M��$ nșJ��Xܙ���ڎ!�Z%sk��c4T)qv�*���Bt���;�qcy�o�s���V��o������K2��B"�b�me꥟�SY�2��v��g�{!8W����7�'J\�����AI�x1�+ea{�^[���P�7.�ٹц��x��z��#��P`A$]�������zʸ�n�BU�v��>:m]�(�H,�Q���Ƕ�B�u��y��H�$GC(I7�x��Z��"a���y<��B����{X.�e�5�; ��=�?̦Ag!Ϭ�����F\;?�\ד7�psw�Xf5�hQ� ����+�3Y6�r���КR�<���V̠��þ 1�D��BX���uX��io6���Q�jQ�@��s� P�\:��i�m���c�x��'�I n�?}>���4xe���ce�^]҆u���(�t��l�����v�ݹW5���)����*I����(Z.�#^�гQ�jV���=r�\c���ėZXV�R��vr�蹰�1!h(�W��đ8�> u]��w�� R�ebxf�@��,{AR�u�X��l�{��l}����d�B�x�$��b�N�!@���:�������/���'�r�������n�gݒ4��,/:DȢ=3��(,�:TC{��r��>�r���ymC%"x��>�b�-���!��T��Î��C��0D��6�E!weL�V�t�e��u����)o��#�}��ȼHҚ��v��8l�_� �9�< �ä�N���Ϥ�?4�'~��MGe��їp������H[v[�G��S!�]�'���kj�}/����B������#k�N��UЙk!�D�u����LZ�D��R�<�����{��J����A�H�n�H v���&�IB�u��8�^�Gdş���Uqճ º�0��Ϫ��sqg]�x8�u�#���̗)Z^�B��J����̀�����ʼ��>:".�c��d�M�J��L2' ���[�4\�y�s��_�(1H���a�5 伭y�a�����'�M�!���}G���^@eKe���x<>=��D���6��M�xE$�b֍v��x�����ʀ��"#���Qj�����g�l��������,�����M��܂ ���YOun���_�}8wDGz�O��c�i3��p��F��@�����C���Ɣ��;4��}1�N�ֹ����#�+�4�����ih��<6�c,9/�Sa�c��ʏ~���9�B���T�S2�C�n!V��Kϝ�A���]�Ȩ���~�B�e�C�����ǁ��2Oǘ�X�����˩��S*j����x���NI쬍e��|�}e�p�Dh4Tf~�m��r!��X�9ؒ�pN{�`S[z�I���ٟau��h�����n�����'�H%����|��$�X�k@���$��Hce_o�(=kJ�3@���݊�����zj�&�V�a}���� ԁ��*�.7 ���0�� ��>f#�"=��P"�F����߁{�+��'b��5�C���/j:K�0e��h�!��T����І,�������= ��<G3���\�9pYo<�2/���Z�X��u���TM�@��ި!�<�6���|�W��G���D��f��Ĵ��ÝI��8���Nc��>`=�]���.�y:��� ��I[��̓"�ۚ��F�W-1H���Z�+�������dTM�<!�P�t��eO�T`@���f��:v0�z��mr'5�O��}O�od��o_�gΧ+"�X����ǹ2��9�*-m�㓒%+;VN�=���>=��g�jR�k�5?%��,�~'�k|Ƚ��������xF�� �q%F�@m�♂l6,:�o ���(ؗ�Hcs��K0:JU� ��Bl��Į��ڒP�"Ʋ���O�r��:��������d��ݰ�SI��}��G�� ?��_εK�>�z�ʧ�w��l���)��!��@2�%w"�����w�k�[����P�v�����}��d��X�~���⍼?��A�l���]d�6��Ŗ{� "n�@���ra����zȽ�:�mk����~��E}M;!���0(�vz=��d���)�^���Dd'u�A���2�>�DK��1��;{� �[jĠx ���I������d��7�h�q{x�np���F5�b�'}�r1�wO�t.�Q���y�iy��Ģ�JI�52e� ����wZ�ě��~.��Ϗ��l�ܓ��;��
Static task
static1
Behavioral task
behavioral1
Sample
Rise/Rise_Selfbot.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Rise/Rise_Selfbot.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
Rise/Scripts/hello.py
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Rise/Scripts/hello.py
Resource
win10v2004-20220812-en
General
-
Target
Rise.zip
-
Size
102.9MB
-
MD5
8db92c97f4ed7d1f53b100ea6763aeb3
-
SHA1
9b4f978e75ff8318d90cd22d286847fc79b469fd
-
SHA256
0a65762f6b5595ae5e211f0eda18b68a86c43bd38dae59878d884c1d91e16bff
-
SHA512
b80289e10f23a96b617e23214e03ded04c5c6c668d89fac2564022d3f2ccf60e61b28839459a99655a2e05758554e14643f2242a43dcb4f41781251ae8b3b541
-
SSDEEP
3145728:9Ox+OqhqYWjD2r+AfcnhofSzwR+aeKFSSrcOeeFul:9OgOYqYWAzchwSA+ASSrcOful
Malware Config
Signatures
Files
-
Rise.zip.zip
-
Rise/Blacklist/blacklisted_afk_users.json
-
Rise/Blacklist/blacklisted_servers.json
-
Rise/Misc/AboutMeCycle.txt
-
Rise/Misc/StatusCycle.txt
-
Rise/Misc/autoreact.json
-
Rise/Misc/channelstalk.json
-
Rise/Misc/console.json
-
Rise/Misc/debugging.json
-
Rise/Misc/discord_api_versions.json
-
Rise/Misc/giveaway_bots.json
-
Rise/Misc/messagereact.json
-
Rise/Misc/on_start.json
-
Rise/Misc/payments.json
-
Rise/Misc/protections.json
-
Rise/Misc/raid_tokens.txt
-
Rise/Misc/richpresence.json
-
Rise/Misc/staff_detection.json
-
Rise/Misc/stalker.json
-
Rise/READ FIRST.txt
-
Rise/Rise_Selfbot.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 84KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 32.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Rise/Scripts/hello.py
-
Rise/Sounds/GhostPing.wav
-
Rise/Sounds/GiveawayEntered.wav
-
Rise/Sounds/GiveawayFound.wav
-
Rise/Sounds/GiveawayWon.wav
-
Rise/Sounds/LoggedIn.wav
-
Rise/Sounds/Success.mp3
-
Rise/Themes/Backgrounds/MbC0SP7.png.png
-
Rise/Themes/Default.json
-
Rise/Themes/Fonts/Roboto-Bold.ttf
-
Rise/Themes/Fonts/Roboto-LightItalic.ttf
-
Rise/Themes/Fonts/Roboto-Regular.ttf
-
Rise/Themes/Thumbnails/ZV3PGwQ.gif.gif
-
Rise/Toasts/Notifications.json
-
Rise/Toasts/Rise.ico
-
Rise/Toasts/Toasts.json
-
Rise/config.json
-
Rise/data.json