General
-
Target
2d4ab242c496991f9c2d0b8bae6bbc6ac6e3af9e6ef4d203d8d1e85e90941e2a
-
Size
1.6MB
-
Sample
231213-3ysezsbfg8
-
MD5
ff2f366a3c766a686a9ae5a74982252a
-
SHA1
cfa3e40713600842e9092ee8499ca33defc8d3ad
-
SHA256
2d4ab242c496991f9c2d0b8bae6bbc6ac6e3af9e6ef4d203d8d1e85e90941e2a
-
SHA512
5eeba1d359ce2cacde4a00524260d3aae5f42854c4f76537635e9ed27a8c6fcf16bcd34982ad3cf9665f0e19f6dd58c043ecd42a13bad1480f25a4a00e02c6e1
-
SSDEEP
49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
Behavioral task
behavioral1
Sample
2d4ab242c496991f9c2d0b8bae6bbc6ac6e3af9e6ef4d203d8d1e85e90941e2a.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
risepro
193.233.132.51
Targets
-
-
Target
2d4ab242c496991f9c2d0b8bae6bbc6ac6e3af9e6ef4d203d8d1e85e90941e2a
-
Size
1.6MB
-
MD5
ff2f366a3c766a686a9ae5a74982252a
-
SHA1
cfa3e40713600842e9092ee8499ca33defc8d3ad
-
SHA256
2d4ab242c496991f9c2d0b8bae6bbc6ac6e3af9e6ef4d203d8d1e85e90941e2a
-
SHA512
5eeba1d359ce2cacde4a00524260d3aae5f42854c4f76537635e9ed27a8c6fcf16bcd34982ad3cf9665f0e19f6dd58c043ecd42a13bad1480f25a4a00e02c6e1
-
SSDEEP
49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
Score7/10-
Drops startup file
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-