General

  • Target

    28b8a98113c83e3221d20e3aeb3abc11987955bcdc19f676ba74a9bff487be26

  • Size

    3.1MB

  • Sample

    240406-fhhvaabg43

  • MD5

    bc04f60229de7bd6c2490ccb429bd458

  • SHA1

    61564ef1284e00a8e04ef8871557dcc37a699319

  • SHA256

    28b8a98113c83e3221d20e3aeb3abc11987955bcdc19f676ba74a9bff487be26

  • SHA512

    ad76934db8b222db509610994b6b0ad97301ae5bb03529919f1492c75c473a23db8378cee41221e3c7aa7825c0c979d1cbdf4662d351bbf1a246180ababd2d07

  • SSDEEP

    98304:ENhV9noYgEZ/FopEf0d4z2OjkTXufUVYm/2k:EjPoYdApyf2RrufUO62k

Malware Config

Targets

    • Target

      28b8a98113c83e3221d20e3aeb3abc11987955bcdc19f676ba74a9bff487be26

    • Size

      3.1MB

    • MD5

      bc04f60229de7bd6c2490ccb429bd458

    • SHA1

      61564ef1284e00a8e04ef8871557dcc37a699319

    • SHA256

      28b8a98113c83e3221d20e3aeb3abc11987955bcdc19f676ba74a9bff487be26

    • SHA512

      ad76934db8b222db509610994b6b0ad97301ae5bb03529919f1492c75c473a23db8378cee41221e3c7aa7825c0c979d1cbdf4662d351bbf1a246180ababd2d07

    • SSDEEP

      98304:ENhV9noYgEZ/FopEf0d4z2OjkTXufUVYm/2k:EjPoYdApyf2RrufUO62k

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks