Extracted

• • Target

    file.exe

  • Size

    5.6MB

  • MD5

    dc609ab902d38535a34a6025180e7f4f

  • SHA1

    56bb1d3b3b5c411fc767acc8ddf7e8305058a7cb

  • SHA256

    d08fc62a60cd555065bf1bb8f0e5d8f1ee6992511eb45038d2640d4438727d44

  • SHA512

    cbe57c9bd5bb411ecc8e5ced731c4e20771bfeffc4ade1e7a88b981ce0801febb733d33957ef63aa8325f780658fc047b8a4b5e221f5bad01d6f8327b04a8f9a

  • SSDEEP

    98304:xIaG82rZ7NQNd4a3f5e41octDkVVVx9i4WgYOb0mn4dzlTvPu7wQIlSe/JEgawtM:fG82r8Nd4a71DgVVFiQh4dBDu7wNld/U

  Score

  10^/10

  privateloaderriseprocollectiondiscoveryloaderpersistencespywarestealer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2