privateloader | 981ba71c9d6bfa2fc6528218d93b3a7f0d5ba54157e5903d25c019d4a4a2ad28 | Triage

Sharing

General

Target

981ba71c9d6bfa2fc6528218d93b3a7f0d5ba54157e5903d25c019d4a4a2ad28
Size

1.5MB
Sample

231124-l7c8zsaf6z
MD5

25c415ea60e5d3b66565ea5a7be84bd8
SHA1

7f7d58ce411d9182f6d91517a35c55a2b5601afa
SHA256

981ba71c9d6bfa2fc6528218d93b3a7f0d5ba54157e5903d25c019d4a4a2ad28
SHA512

4eb42bf9fc39d09b5a8c67bfd81fa9cbd2638d02d2d70432587507164161ed2ae272e50bad5bdf95bd197c789d63a9891ea8804174066219a7d4e1950792b5ee
SSDEEP

24576:8N+bPGUvbX8AdjI9Bahe/wz78RaiyhrbnC3OlKekN4srzEhbaLUCKWmRlsSmYTzC:8wyYjI9EheW7WaiUy3V6baLUCmRlnmYq

Score

10^/10

privateloader risepro persistence

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Targets

- Target
  
  981ba71c9d6bfa2fc6528218d93b3a7f0d5ba54157e5903d25c019d4a4a2ad28
- Size
  
  1.5MB
- MD5
  
  25c415ea60e5d3b66565ea5a7be84bd8
- SHA1
  
  7f7d58ce411d9182f6d91517a35c55a2b5601afa
- SHA256
  
  981ba71c9d6bfa2fc6528218d93b3a7f0d5ba54157e5903d25c019d4a4a2ad28
- SHA512
  
  4eb42bf9fc39d09b5a8c67bfd81fa9cbd2638d02d2d70432587507164161ed2ae272e50bad5bdf95bd197c789d63a9891ea8804174066219a7d4e1950792b5ee
- SSDEEP
  
  24576:8N+bPGUvbX8AdjI9Bahe/wz78RaiyhrbnC3OlKekN4srzEhbaLUCKWmRlsSmYTzC:8wyYjI9EheW7WaiUy3V6baLUCmRlnmYq
Score

7^/10

persistence
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

privateloaderrisepro

behavioral1