Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b2f24660f0c75e0d3a8b553856a348fa.exe

  • Size

    2.2MB

  • Sample

    240507-qlnj2shc9w

  • MD5

    b2f24660f0c75e0d3a8b553856a348fa

  • SHA1

    be5c9c069bb87ec763fe2f057a0e409c987c0e4a

  • SHA256

    1205c112ad35995a65e8131892a89150911994d5a95dbfa114e34857e79a5045

  • SHA512

    47cd041542d352fc290c455313225b400cc9cf550b4100513ae94e0b4002add84c0dd6e2151cdc49e86acc298f818d397e3f97f330eb405298253017ee87cdab

  • SSDEEP

    49152:MuAbMFmAwbrWM70aYrlc4tf9xoU5t3ghZtkPL26cP0cLsE:UbmmFHWM7vqW4tlxV59yZiD4vwE

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Targets

    • Target

      b2f24660f0c75e0d3a8b553856a348fa.exe

    • Size

      2.2MB

    • MD5

      b2f24660f0c75e0d3a8b553856a348fa

    • SHA1

      be5c9c069bb87ec763fe2f057a0e409c987c0e4a

    • SHA256

      1205c112ad35995a65e8131892a89150911994d5a95dbfa114e34857e79a5045

    • SHA512

      47cd041542d352fc290c455313225b400cc9cf550b4100513ae94e0b4002add84c0dd6e2151cdc49e86acc298f818d397e3f97f330eb405298253017ee87cdab

    • SSDEEP

      49152:MuAbMFmAwbrWM70aYrlc4tf9xoU5t3ghZtkPL26cP0cLsE:UbmmFHWM7vqW4tlxV59yZiD4vwE

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks