Overview

overview

10

Static

static

3

npp.8.6.5....er.exe

windows7-x64

10

npp.8.6.5....er.exe

windows10-2004-x64

4

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...al.ini

windows7-x64

1

$PLUGINSDI...al.ini

windows10-2004-x64

1

$PLUGINSDI...er.bmp

windows7-x64

3

$PLUGINSDI...er.bmp

windows10-2004-x64

7

$PLUGINSDI...rd.bmp

windows7-x64

3

$PLUGINSDI...rd.bmp

windows10-2004-x64

7

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    npp.8.6.5.Installer.exe

  • Size

    4.5MB

  • Sample

    240514-wpkkfshb61

  • MD5

    6f7e2e04a4e06254fd1454515eb0331d

  • SHA1

    ba940c6b526da1ce127f43b835b4d8c9d5c4b59c

  • SHA256

    5180a17f24df75ccc000cdc2904b14c865ccfd7521909bf06cc75189a65c3e2f

  • SHA512

    b230bea0ea463a34c3f01c5714d2dbd8dc9023ac373e46f4ec821fabb876d977fe3f5814740e903650a3d604422fef12bd7bbab7e1b531d9688af8111b30d859

  • SSDEEP

    98304:QtvgozJADSd6ovPc4QVt/hJGpV+zKwarmdnIDVI8Fy0lrAJ+exPf2:QthzJsSb3PqJSyKwaKp83y0lrclxPf2

Score
10/10
riseprodiscoverypersistencestealer

Malware Config

Targets

    • Target

      npp.8.6.5.Installer.exe

    • Size

      4.5MB

    • MD5

      6f7e2e04a4e06254fd1454515eb0331d

    • SHA1

      ba940c6b526da1ce127f43b835b4d8c9d5c4b59c

    • SHA256

      5180a17f24df75ccc000cdc2904b14c865ccfd7521909bf06cc75189a65c3e2f

    • SHA512

      b230bea0ea463a34c3f01c5714d2dbd8dc9023ac373e46f4ec821fabb876d977fe3f5814740e903650a3d604422fef12bd7bbab7e1b531d9688af8111b30d859

    • SSDEEP

      98304:QtvgozJADSd6ovPc4QVt/hJGpV+zKwarmdnIDVI8Fy0lrAJ+exPf2:QthzJsSb3PqJSyKwaKp83y0lrclxPf2

    Score
    10/10
    riseprodiscoverypersistencestealer

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

      stealerrisepro
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      15KB

    • MD5

      d095b082b7c5ba4665d40d9c5042af6d

    • SHA1

      2220277304af105ca6c56219f56f04e894b28d27

    • SHA256

      b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

    • SHA512

      61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

    • SSDEEP

      192:EyGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTr11929WtshLAzgSrX8:EyNt+4t7uJalUnGesY7Lt8nCr/Yosa

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      4add245d4ba34b04f213409bfe504c07

    • SHA1

      ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    • SHA256

      9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    • SHA512

      1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    • SSDEEP

      192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/ioSpecial.ini

    • Size

      211B

    • MD5

      e2d5070bc28db1ac745613689ff86067

    • SHA1

      282e080b4cf847174c5c11e4f9157b8c338ecb19

    • SHA256

      d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0

    • SHA512

      a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de

    Score
    1/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/modern-header.bmp

    • Size

      25KB

    • MD5

      a70c3979ab1716c84969eb73618ca7d7

    • SHA1

      f0b4c8c1b8c59aa0382ae4f65263a389a3cc3996

    • SHA256

      e6c5be8aba1f657fe77e8c9bbfac3536a69530aa5c1411cc3d6c235373203a46

    • SHA512

      3d0eba870b91f08a6e7b380d0137f6415d1184a77643521e7b2a01774272971853774b72517921a788ae7c606e3940c39fd36f03a7da76c972d1ef1adbc0e409

    • SSDEEP

      384:1oacST1ci4MZzWc5bgoUK+RQ0s6SLARs2v/C7zAkAFTqI+4TFWAWGQg5s:CaciEMZzPcoUK+a0sD52HCYkCTTmABw

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral10behavioral9

    • Target

      $PLUGINSDIR/modern-wizard.bmp

    • Size

      150KB

    • MD5

      c2cf6928a3ab574a5548b4dc1c38b6c0

    • SHA1

      8860ff529f60b38a93912f88f234d46eebcf664f

    • SHA256

      2125550c12fa512782f2016e802d70bc51f4a06017cfbd4176b4a994eb2542f0

    • SHA512

      fb6b28f2677b1418f8ebf621dd1e201b127b53b998c02300caa66a9f374f681961f5b9a7f843d6082821890df9e3d91a3403b4f83d70d155e9c841893e1f80e4

    • SSDEEP

      3072:NKrK243U6RNfWAKVZ17e28FTfWDG7wFlF9:NKW3UMfWTpe2eODG7UF9

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral11behavioral12

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1d8f01a83ddd259bc339902c1d33c8f1

    • SHA1

      9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

    • SHA256

      4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

    • SHA512

      28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

    • SSDEEP

      96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc

    Score
    3/10
    behavioral13behavioral14

MITRE ATT&CK Enterprise v15

Tasks