Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    039079058a507972b58ebaa257e59ab92c8b4d1abee9737ac9b874ee8a977f63

  • Size

    749KB

  • Sample

    231127-brxbtade58

  • MD5

    167e203c5b4830526f1d92bb090a8fcf

  • SHA1

    92c653a88dc976058860ef66d7b4ee8ba5b4687f

  • SHA256

    c1171c27b3e2478f3fffd31a2b5bc1be41cbf569e6284c49ed17b2f02975630a

  • SHA512

    2a31b8cc61f9f977ac4fd9389d42a325be3a764491df6510023683168faceee0d0a92bc3b68f3dbf9498442639d53b6b7fb7418c9c4818f001569ca5c7942a1f

  • SSDEEP

    12288:ctPFtGfY2o0E2DLHRJPRWWL03wiiZPgwuk4TUYJ4eyuz1VYwpvw4AXlB2vkG:cdHGq0E0R+k03wFPgwuVTPV1Cwpv2D2r

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Targets

    • Target

      039079058a507972b58ebaa257e59ab92c8b4d1abee9737ac9b874ee8a977f63

    • Size

      1.5MB

    • MD5

      0361c4f365602ee5599c3d1137c82393

    • SHA1

      ac61409637c6f0e0f6d354f640e6338e024f6c95

    • SHA256

      039079058a507972b58ebaa257e59ab92c8b4d1abee9737ac9b874ee8a977f63

    • SHA512

      4b36877175fdfa7924f485317b2d68652c157c66c0b5bd28948ecd8e64ae206bed6a4751288d238263de488a1fd58370306661e91625de1d015272a00a0c2633

    • SSDEEP

      24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks