General

  • Target

    0166d0371a9ea7a89566ee13137779bab2e125a544dbb9e3fab8913e0ed6c28b

  • Size

    1.6MB

  • Sample

    231214-agg9gaacdk

  • MD5

    0e19a17ec0a08f56bbe93cd19ed93fe8

  • SHA1

    5eb98e8a440857ca660d5adea49519ad3a77d62f

  • SHA256

    0166d0371a9ea7a89566ee13137779bab2e125a544dbb9e3fab8913e0ed6c28b

  • SHA512

    bd2e442f09c2f944e6ccb6c7e47a69983ab7e54911e8ab515055b8c99dbdf3e0c925151fe409b5f1b4b31bbc90aa36abed0f8a9cb75ba2cb3aa38585e4e10dde

  • SSDEEP

    49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Targets

    • Target

      0166d0371a9ea7a89566ee13137779bab2e125a544dbb9e3fab8913e0ed6c28b

    • Size

      1.6MB

    • MD5

      0e19a17ec0a08f56bbe93cd19ed93fe8

    • SHA1

      5eb98e8a440857ca660d5adea49519ad3a77d62f

    • SHA256

      0166d0371a9ea7a89566ee13137779bab2e125a544dbb9e3fab8913e0ed6c28b

    • SHA512

      bd2e442f09c2f944e6ccb6c7e47a69983ab7e54911e8ab515055b8c99dbdf3e0c925151fe409b5f1b4b31bbc90aa36abed0f8a9cb75ba2cb3aa38585e4e10dde

    • SSDEEP

      49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uonTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u

    • Drops startup file

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks