Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    20ac7ca97a09343ee246c5139c833c4d.bin

  • Size

    749KB

  • Sample

    231127-bmjvxsde39

  • MD5

    98e5889d63d875728ad303a23f37cdfd

  • SHA1

    66009897da1862f84c30489c644e44fa3ed90ced

  • SHA256

    863cba5d316a7122e518ffa0b382b6a7c11ec5ec2a0514b6eef9259e9173e3c1

  • SHA512

    165b22a5e85c55a3017ce06295633e0de49979a7a6b8d598450338cff119f2ee91b98d7064b6f00b86280d2c20bcf1eb2402cd707b54a9f1dc7925656460166b

  • SSDEEP

    12288:h5ucf1mUeYW1Id3vA4eH+DqAgqP4YLyEg6KLK8kDD73tNLdLbxf87KZixCKBXU:Be1fRen+GwGBbXJbxU7eQFE

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Targets

    • Target

      7ae506f17215e1e2a05b21e5d4bdf6836dd7566f2bb65de6a512124416d920ee.exe

    • Size

      1.5MB

    • MD5

      20ac7ca97a09343ee246c5139c833c4d

    • SHA1

      991a043128b10fb0774ebadad41eb2301a4e24d0

    • SHA256

      7ae506f17215e1e2a05b21e5d4bdf6836dd7566f2bb65de6a512124416d920ee

    • SHA512

      144c88cd527dad0c54422554bb80b96234e25255df43d30e95850d7dea2372dc97e4351b9044de58b712b084b2d0bae927d730ddbb771c5b34d9bbfb7f449ce9

    • SSDEEP

      24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks