Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25

  • Size

    3.0MB

  • Sample

    240502-gwyy4adb87

  • MD5

    9244c9152a1da8e7b2d5760c7312b65e

  • SHA1

    fd5ee2bd38f508872ba2f1c32092713153aff99d

  • SHA256

    d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25

  • SHA512

    3126e3782408af44bc4598670cb43e65cdc6b1a7a7a84c2974aaaef590c396c39a6ed533adbf2aedac0568c1d7a729c916d9362e76cd666eaa64f392d13c430b

  • SSDEEP

    49152:odQJdpyT6EmAWwOwTQdni6e/JKmdsFv/7nXTF5aXNVaBoqT24Ni/VM8apcTpe:odMdpIfWwITEKmWRLTF8/X/CIo

Malware Config

Extracted

Family

risepro

C2

194.169.175.128

Targets

    • Target

      d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25

    • Size

      3.0MB

    • MD5

      9244c9152a1da8e7b2d5760c7312b65e

    • SHA1

      fd5ee2bd38f508872ba2f1c32092713153aff99d

    • SHA256

      d210b038c83af1db1e65d2531b094451830722acaacbecce0048b62a4aa68c25

    • SHA512

      3126e3782408af44bc4598670cb43e65cdc6b1a7a7a84c2974aaaef590c396c39a6ed533adbf2aedac0568c1d7a729c916d9362e76cd666eaa64f392d13c430b

    • SSDEEP

      49152:odQJdpyT6EmAWwOwTQdni6e/JKmdsFv/7nXTF5aXNVaBoqT24Ni/VM8apcTpe:odMdpIfWwITEKmWRLTF8/X/CIo

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Drops startup file

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks