Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab

  • Size

    749KB

  • Sample

    231127-ccv1wadf73

  • MD5

    81dee1c22caca7f3b55419ec4874ab7a

  • SHA1

    67dbf37d4b8c5e175d2318564213516bb4ec1869

  • SHA256

    60e83a2aab985e512c1d50ad2a7580dbefc8a3d3425ff1d13612edc3e00a6d70

  • SHA512

    b688bdbdeb4da2d2eed999a10ee17f8ece66c153fa6955ed2105a005e7e81df907113be5d8e41f44a3b005fcb86798b83a75040703e616e290dad60e2cba5798

  • SSDEEP

    12288:ztPFtGfY2o0E2DLHRJPRWWL03wiiZPgwuk4TUYJ4eyuz1VYwpvw4AXlB2vk0q:zdHGq0E0R+k03wFPgwuVTPV1Cwpv2D2Y

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Targets

    • Target

      ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab

    • Size

      1.5MB

    • MD5

      f3c88013538d71aedd9fd37acc71d968

    • SHA1

      62cca485047adcc3f357f8a91d1974a188c58099

    • SHA256

      ba750c9db7f06008205b3d93a947f6c2c94d92dba50eb08816e7b6dca51099ab

    • SHA512

      f0b1936987966fe61db23493e30772dd02a221029699da3ea152dc5e424b20c9829ce58cc1ec5ea5250827e4e40b2eaae40fd809d619874183d10a73c194e0f5

    • SSDEEP

      24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks