Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2f3d56024cec0e8f160ff69fd844d77f4905d6d48bd1c51fe6adaaf38fe10dcb_NeikiAnalytics

  • Size

    2.2MB

  • Sample

    240521-lrdjtagh71

  • MD5

    0e4c93e1fad1c13bffc809651f2e97fe

  • SHA1

    b333494af4103a95e15970a7d8e9dc48ef995a63

  • SHA256

    2f3d56024cec0e8f160ff69fd844d77f4905d6d48bd1c51fe6adaaf38fe10dcb

  • SHA512

    3caa23f92418376b29b3a4e7bb6d771943644c5e8e7cf6383cdd37cc8bb04d315e60e988275c3e59d3db5b6c66fe7e0c40172484ff676b785ace195f6045c295

  • SSDEEP

    49152:TbnuPRZRZOHqMDOSRg1QWXiSdVVooaaRpjfeWj:Xath7iWSSJokBmWj

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Targets

    • Target

      2f3d56024cec0e8f160ff69fd844d77f4905d6d48bd1c51fe6adaaf38fe10dcb_NeikiAnalytics

    • Size

      2.2MB

    • MD5

      0e4c93e1fad1c13bffc809651f2e97fe

    • SHA1

      b333494af4103a95e15970a7d8e9dc48ef995a63

    • SHA256

      2f3d56024cec0e8f160ff69fd844d77f4905d6d48bd1c51fe6adaaf38fe10dcb

    • SHA512

      3caa23f92418376b29b3a4e7bb6d771943644c5e8e7cf6383cdd37cc8bb04d315e60e988275c3e59d3db5b6c66fe7e0c40172484ff676b785ace195f6045c295

    • SSDEEP

      49152:TbnuPRZRZOHqMDOSRg1QWXiSdVVooaaRpjfeWj:Xath7iWSSJokBmWj

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks