General

  • Target

    806e2088a0591c627ea1a4fe52425b3c94a10415a050de71cfcf7027c8230216

  • Size

    1.6MB

  • Sample

    231213-3d2g6abeh8

  • MD5

    e739f06444475d92ccf6461811bc1c88

  • SHA1

    b651f39df70aa358ef8664f171f17ed8509fa69d

  • SHA256

    806e2088a0591c627ea1a4fe52425b3c94a10415a050de71cfcf7027c8230216

  • SHA512

    8873af608a65b7c430d8357c4e5235581f912d4e97c0702e145f5104fae7f6a0edf39b4c1dbcce4c556c653a3a33fa696dbb5ed5488eb5f42aa6f8eda58237e4

  • SSDEEP

    49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Targets

    • Target

      806e2088a0591c627ea1a4fe52425b3c94a10415a050de71cfcf7027c8230216

    • Size

      1.6MB

    • MD5

      e739f06444475d92ccf6461811bc1c88

    • SHA1

      b651f39df70aa358ef8664f171f17ed8509fa69d

    • SHA256

      806e2088a0591c627ea1a4fe52425b3c94a10415a050de71cfcf7027c8230216

    • SHA512

      8873af608a65b7c430d8357c4e5235581f912d4e97c0702e145f5104fae7f6a0edf39b4c1dbcce4c556c653a3a33fa696dbb5ed5488eb5f42aa6f8eda58237e4

    • SSDEEP

      49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u

    • Drops startup file

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks