Extracted

• • Target
    file.exe
  • Size 960KB
  • SHA256 9aa7d4f91a7d0694867f4b89a07ed978524208be19e22e93fb34ec9fb0b74e2b
  • MD5 015ccf1dd250c360d4b3112bb133237d
  • SHA1 cbfa36cff037162a182a9643a57a15126db6f0da
  • SHA512 5f2e3d16b1011cbbec04ab55ee79c0c632c0f4dd49654d115bec9bf32a50192b4ec24f1c8834c42a14c8b24b786adddd84fec8cd236300b7042b0389c4482fd9
  • SSDEEP 24576:ZGkM2Sj803RooNc6AXSFYfpfx5T9KJWqY9:gkPSj80hNcHiFmppV9Ke
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  privateloaderriseprocollectiondiscoveryloaderpersistencespywarestealer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2