�=�.��ʊwkz����n-�/"֗�[��rM�������$��ݖ?��Rg�{f��w0����'�'Z*5� �I��A`����A�;��S��L9�l��F��6���䫘�1n�G沜C+]�q?Ho��=L�Vo���Ÿg��{�u� ��R�k=vo�v����i��F%5=5�u����U?�H�G�_��D�Lɵ�)���p|I<'<'b��G�Nk����D��v�U)����Ax{\h`�)ؚ5�^d.<&�L����.8�n �*�+ώ�&��>= ������ =57_-���\�O��0��u�È��Ԇ��y��ӧ��I�Z��i+��=�Q���/^}�EYvT��F��{�x_��'t��[Zz0����kS� �4��5�28�йy*��p�G�(�����t�����.%j�$��3[KO���(�ƭw�٣�p%��/g��h�}xb��1P��t��x�Z'��B��ėDh����C+_ :��-�ag�震�s�Z >�B���-O�|��_7f��ޢE�X����la��7]�7�m��O`x ���c��Y4ȕ�Ӝ�� h:�pLW���S@�#�7�W�jD�izT��V ���l�1p�r���`� l,���ä�Sm�:�vd��6�[�Ч������L�5� �A���v���Yζ����������ܮ����SP|����|@?��ᨃ"������(E���AK��g=s�Q�)R�~'<g�+�r_��utIL�ӱ����-_sqw�/l�XJ����3��p5�������?�®��,Nʖyw"BD�|���������B��� `O�T�Ux�_ fpG�ԕ:4�EBi=��-M�O&6����Pc�:����|QfC�^�h����������qlx��)#h��H@�e�*8`s~p]�F��I�&3}�O�<h�l���!D��� K��c�> �A+���w\%�����-�����A�rV�;�O���ԉx9B����o�W�����bl 0.����/M�kD�9C��L �5M۔��1�k��-�����q�L�߀��r}Ы�#.�d�\'��$R+@��J�k_n������-Q�_Ѹ<���4g��^ش�m�� ���K�ƕ�W��#�6�¦�;͑��U�o.�.��jO�}^�qb1�}�9�,=�Ve�!0<լΥ�yix�p Sv�.,�E�yx�����8]X����e�k������<o±���$�|�k���:�ȟ���a�[m[��#�=F�e� '�O ꞥu�y�@�ޥ�Mo7G����kB���ys���0,��]c%���;������0��P�������r�(�P�p�X9�_J��S[K�������l.��S6G�l�B�A39�1(���[6V0�~�1ܻdrq{�l�Fqx����+�����U^����UNM&��'X��Š�Q�Ņ7�z"��=�1�[�c���i�`��m���B�zm ;Th��r��ʜ&ȕQ[��㷰)5!��=h�z0L�y>�*���/V�%��e̮m����#M��jԀC�;�d�/�� ��pn��}�Ӯ����+� 8�.{rQa����s��zw���'�3�)U�kP�#f�dG��}�7N�剠���u��3a^7���61�zN��v���<F<d�����x��(4����|.2�-��R��I�=vtYsމ�2��ᥦ�[�J�M�u�h����n0��ި��|���`���ߵ%��k�}���U>�܉T�ߓ8v��Y�(kO�fh {,�M*���^$$R�iڊ�>@��^�!X��t�C{;��d�Ur��>�Ɗ��#�����h�R����� ���s� ���Ϛ�|��\.k�Ȕ%�}h�����ܳ �7y�Pӌ0Y�]�V�f(j�w?��7���J�~���Ip̀�ǟ�<�e��O�����I�SE��� �\�Ck'`0����v�{�Q���$��R�ꤛi�.r1I��S�,�We��� �0R����5E�B�k��]�y�YKnڭ���ŖH_}������"Z�a��� ��P,�}=��M��W�r��G;��5�m��O��?�����5�!4/Afp�w��7E�o?>�����T��15 �H$�;d'&mb�puT�q�y�7у�+�Z���zLϤN`1�vPЋJ,�������ǝ8m�kI!8����Q��D���.@CJJUMcU����T�q����21~�N��|R�c<�U�=ݝ�ٷ�y��r��v� �tsR��3�&�Gc���&�,����~} w�65�S�~MѾ��#�����[ݯk��-�3�=����>��Ng$,a3���G:��_ ���<��<������;c�F���5��/?����$'�b���\�$a?��~0�2Ǖ�����NR8,+?B�]:�� ���sa���f}�����A�I'Pι������'���d��ۨog|)��Z�KϨ0���:{zJ�q���2��}?*G���l�N�ӧS�8!:Ě�|��@^~�xb��.��p����0/��(n��I���ar�N��4�l�?��8�!4����Ἵ!��>k":������3����v�nr`�)"G�/����s@�����s���Ux�&X�8��d-�0#WGq%�c�X����V�MɪbH�N.5:ɶ� 'EL9����� >���qît�1I�-�LR�<��ع$ R`?��e���#]���������:X��ZrO��u�fY{k�b�]Q�/4��˫A0@'�7�%��Aթ`����ӹ[��㹣{�-�$'�癵�\ ��^���"��&#=�q���*�����.Q�a���U�`��(iM�u���5:�2hu>zJ�9<���ω���8�"�oU\)�5��a�N���+ ��C<S���z�B�_}c��eQ��*ׁ���|��8�AK�-ώ)h6��~�+���Z'���K��q���DZ��B}3f�cmX��]D���h��A�*�O_���MZ��G�t���������;��%]X{�+�a
Static task
static1
General
-
Target
Rise-Selfbot.rar
-
Size
38.8MB
-
MD5
1643e06404f8d513e3c1123cc86c7e3a
-
SHA1
4e86fd643240dc756740814a76f4d2e6b3167b41
-
SHA256
38b33f046072aa942a319c847d87fae8fafd3ffd7e858961f2391045ee092aa0
-
SHA512
7badf0c30493ebbe7710631f77fb916d9a4009839fd79adfea14ad7d45d2c75999e57fd03890b991e83e97f76404c90d108cc1624bc4b58b37aa51da3fd3e7ee
-
SSDEEP
786432:PG05QARg8JqMYEj81gKU74AiRANKxzDSBSKqqWZOI:nQAR3qDgb7diRY0+AqG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Rise-Selfbot/Rise_Free.exe
Files
-
Rise-Selfbot.rar.rar
-
Rise-Selfbot/Rise.ico
-
Rise-Selfbot/Rise_Free.exe.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 83KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 33KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 20.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20.6MB - Virtual size: 20.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 273KB - Virtual size: 32.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Rise_Free.pyc
-
Rise-Selfbot/settings.json