privateloader | dca6758665c179b0d31cf916269a6b7af3efc41d1bde70260056b5a1527d27bb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dca6758665c179b0d31cf916269a6b7af3efc41d1bde70260056b5a1527d27bb
Size

1.5MB
Sample

231128-lf8ktaha5t
MD5

d5143895e9a30e2fb1cf5a3cb301ff56
SHA1

72d72feaa43481aa5228999c5570fce5a5bff955
SHA256

dca6758665c179b0d31cf916269a6b7af3efc41d1bde70260056b5a1527d27bb
SHA512

09ed6f99b050fc056b8c210e79747fd280759b861bdce4c881dd11d4315d31291b082c94b90e68e6b8f84e138d3d70f3bfeeaac612ebe0f357eb927e957119f3
SSDEEP

24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WtI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTS

Score

10^/10

privateloader risepro persistence

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Targets

- Target
  
  dca6758665c179b0d31cf916269a6b7af3efc41d1bde70260056b5a1527d27bb
- Size
  
  1.5MB
- MD5
  
  d5143895e9a30e2fb1cf5a3cb301ff56
- SHA1
  
  72d72feaa43481aa5228999c5570fce5a5bff955
- SHA256
  
  dca6758665c179b0d31cf916269a6b7af3efc41d1bde70260056b5a1527d27bb
- SHA512
  
  09ed6f99b050fc056b8c210e79747fd280759b861bdce4c881dd11d4315d31291b082c94b90e68e6b8f84e138d3d70f3bfeeaac612ebe0f357eb927e957119f3
- SSDEEP
  
  24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WtI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTS
Score

7^/10

persistence
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

privateloaderrisepro

behavioral1