General
-
Target
https://cdn.discordapp.com/attachments/1211236203525840908/1211237262600306708/release_file_v2_0.rar?ex=65ed779b&is=65db029b&hm=d92dc89cae20880c8ba7be66594a20432fce482dc1495680034b69fece23ddf9&?space=File.zip
-
Sample
240225-ppm71scc61
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1211236203525840908/1211237262600306708/release_file_v2_0.rar?ex=65ed779b&is=65db029b&hm=d92dc89cae20880c8ba7be66594a20432fce482dc1495680034b69fece23ddf9&?space=File.zip
Resource
win11-20240221-en
Malware Config
Extracted
smokeloader
pub3
Extracted
risepro
193.233.132.62
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1211236203525840908/1211237262600306708/release_file_v2_0.rar?ex=65ed779b&is=65db029b&hm=d92dc89cae20880c8ba7be66594a20432fce482dc1495680034b69fece23ddf9&?space=File.zip
-
Detect ZGRat V1
-
Detected Djvu ransomware
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Modifies file permissions
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-