risepro

General

Target

759d952e9f3d5985ee40f8c79e90ec327c8010a7ea40c36f24a773c25b31d143
Size

4.9MB
Sample

240425-dd46lsec9y
MD5

40a21dc4274cf6e85bd88a04be5d0db3
SHA1

8c2a7c04fad48aa1e7379b38ac7506ee3a5dbe7c
SHA256

759d952e9f3d5985ee40f8c79e90ec327c8010a7ea40c36f24a773c25b31d143
SHA512

55919e372b4ab666f9c1cae17129a848390a0a30cd62dd38f218bdc04544de17dca310370f2ffefd0879d957b0c340ceb1fd69a12c8ded99be05b4e786497fb1
SSDEEP

98304:G3NYiICv2T0bc/uaMKJiNQqjxpAda2CLpI1ouW6ttx5Gag23J:Gntuw4GKJiNQqjxp6UI1op6tjoO3J

Score

10^/10

Malware Config

Extracted

Family

risepro

C2

193.233.132.253:50500

Targets

- Target
  
  759d952e9f3d5985ee40f8c79e90ec327c8010a7ea40c36f24a773c25b31d143
- Size
  
  4.9MB
- MD5
  
  40a21dc4274cf6e85bd88a04be5d0db3
- SHA1
  
  8c2a7c04fad48aa1e7379b38ac7506ee3a5dbe7c
- SHA256
  
  759d952e9f3d5985ee40f8c79e90ec327c8010a7ea40c36f24a773c25b31d143
- SHA512
  
  55919e372b4ab666f9c1cae17129a848390a0a30cd62dd38f218bdc04544de17dca310370f2ffefd0879d957b0c340ceb1fd69a12c8ded99be05b4e786497fb1
- SSDEEP
  
  98304:G3NYiICv2T0bc/uaMKJiNQqjxpAda2CLpI1ouW6ttx5Gag23J:Gntuw4GKJiNQqjxp6UI1op6tjoO3J
Score

10^/10

risepro evasion stealer themida trojan
- Detects DLL dropped by Raspberry Robin.
  Raspberry Robin.
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects DLL dropped by Raspberry Robin.

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2