Extracted

• • Target

    ecd41e712f27cdf177af4d2fb45d64734ace0831263536d343c1259ab2cf0c57.exe

  • Size

    5.0MB

  • MD5

    32a8996291f69b743e97227e0d6d071b

  • SHA1

    6390b31bc0489ad5a35234412f5d9257706ef075

  • SHA256

    ecd41e712f27cdf177af4d2fb45d64734ace0831263536d343c1259ab2cf0c57

  • SHA512

    aecf7c64c0a48f856a0bbe5399d11f377031337e5933d746e0b743ec693a155a8a797deda4a2b63a63510b726387eed8b9f76b17e74c8672a000a9676858afc7

  • SSDEEP

    98304:Zs0zDm2QgSrZhOd1n4NobHSV+4uWrG8btG4WVYwo6NZzN/syF3QPNlYUe9:ZzrmZhO/4ObHV4uIb9DSLxsyur

  Score

  10^/10

  riseproevasionpersistencestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2