Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    e6628ac29b6d898bcdcc73b99e38ef6f67ee48245e68b3f95085d6d3cdd9fea9

  • Size

    2.3MB

  • Sample

    240503-g6tr5ahb3t

  • MD5

    f6565b7a842c47b95031821a1d55a22f

  • SHA1

    7f769202c399c63f8d998a9d29d826d3e363a66b

  • SHA256

    e6628ac29b6d898bcdcc73b99e38ef6f67ee48245e68b3f95085d6d3cdd9fea9

  • SHA512

    4f2717f3a3fdce40f6b8d89d32e42cfe063c6b556ac68e2fa0e7671299229cdd0a03143022a4ed70198bde01782b42b60b5f323d808026b00da845ea0d0625ae

  • SSDEEP

    49152:MGY5918NqwTEgTcQdcoobvhDt0t6fHl9EsOYA1t8un:lhTPdcl7hDRHf1ODt8un

Score
10/10

Malware Config

Extracted

Family

risepro

C2

147.45.47.93:58709

Targets

    • Target

      e6628ac29b6d898bcdcc73b99e38ef6f67ee48245e68b3f95085d6d3cdd9fea9

    • Size

      2.3MB

    • MD5

      f6565b7a842c47b95031821a1d55a22f

    • SHA1

      7f769202c399c63f8d998a9d29d826d3e363a66b

    • SHA256

      e6628ac29b6d898bcdcc73b99e38ef6f67ee48245e68b3f95085d6d3cdd9fea9

    • SHA512

      4f2717f3a3fdce40f6b8d89d32e42cfe063c6b556ac68e2fa0e7671299229cdd0a03143022a4ed70198bde01782b42b60b5f323d808026b00da845ea0d0625ae

    • SSDEEP

      49152:MGY5918NqwTEgTcQdcoobvhDt0t6fHl9EsOYA1t8un:lhTPdcl7hDRHf1ODt8un

    Score
    10/10
    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.