General

  • Target

    d661b08dfac49bac58f07815ff8d3d680007f05cb3db878439c16ac9913abd9a

  • Size

    1.6MB

  • Sample

    231213-3k3zkabfc4

  • MD5

    b7f343ab07d73b9d3206829f49bc5942

  • SHA1

    0ccd7ef84c0f87fd80d76b8a969da3ed152b9bd6

  • SHA256

    d661b08dfac49bac58f07815ff8d3d680007f05cb3db878439c16ac9913abd9a

  • SHA512

    810185825af3fadf3e9a00db88242436d54753371fcbf13936e2b1896748911eedd0b63a23a3ebaf56283625d9080708fefa81fec7a6ffec641546bf20ee95e9

  • SSDEEP

    49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Targets

    • Target

      d661b08dfac49bac58f07815ff8d3d680007f05cb3db878439c16ac9913abd9a

    • Size

      1.6MB

    • MD5

      b7f343ab07d73b9d3206829f49bc5942

    • SHA1

      0ccd7ef84c0f87fd80d76b8a969da3ed152b9bd6

    • SHA256

      d661b08dfac49bac58f07815ff8d3d680007f05cb3db878439c16ac9913abd9a

    • SHA512

      810185825af3fadf3e9a00db88242436d54753371fcbf13936e2b1896748911eedd0b63a23a3ebaf56283625d9080708fefa81fec7a6ffec641546bf20ee95e9

    • SSDEEP

      49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u

    • Drops startup file

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks