privateloader | 0396e3cdee8fa2d9ba2a2cd0f7855df65ff1dea574f67b9f7be9d80770d7f766 | Triage

Sharing

General

Target

0396e3cdee8fa2d9ba2a2cd0f7855df65ff1dea574f67b9f7be9d80770d7f766
Size

1.5MB
Sample

231127-srvlnahd72
MD5

6f5840919db500c986e87912c92bb802
SHA1

da51aca48c488521bf1fa11eedac3b9212629007
SHA256

0396e3cdee8fa2d9ba2a2cd0f7855df65ff1dea574f67b9f7be9d80770d7f766
SHA512

b6bd735a2b48f308ca97e95318f9b52e3cb1b764d5cd4977d0453e5d3f1b0cd0613c341600fb342fc9ff86aee105d606cc24c799dd61e041a2b329617d19426e
SSDEEP

24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy

Score

10^/10

privateloader risepro persistence

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Targets

- Target
  
  0396e3cdee8fa2d9ba2a2cd0f7855df65ff1dea574f67b9f7be9d80770d7f766
- Size
  
  1.5MB
- MD5
  
  6f5840919db500c986e87912c92bb802
- SHA1
  
  da51aca48c488521bf1fa11eedac3b9212629007
- SHA256
  
  0396e3cdee8fa2d9ba2a2cd0f7855df65ff1dea574f67b9f7be9d80770d7f766
- SHA512
  
  b6bd735a2b48f308ca97e95318f9b52e3cb1b764d5cd4977d0453e5d3f1b0cd0613c341600fb342fc9ff86aee105d606cc24c799dd61e041a2b329617d19426e
- SSDEEP
  
  24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy
Score

7^/10

persistence
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

privateloaderrisepro

behavioral1