s�pzz��X�mN�*˿����vFT���ugP������H! ����[j����<G)��%VNݢj��D5JUi���q�u�T5��;��h�����Z�ɺ �<R��b[9���ç��G�@&ޢ� ��d�v}~%J�� ����iW�8�z����3��o������֒)|����죿�K�R���K�E��N�ww]�ĭ:�Qx�jsLY_�}��RJM��<�2�64=��l8� �,k���P� ���3������:C���?]�O���F�0Wۆ�vA<Ia��3e�)˖��A��������y�9��n��?����Q'l�bK��^Vfʋ2 ~�`�\+̠��a�r�-��-��j����-Q��jXj7�ښ�@?�1qW�Ry��3�Oi�;c�W); ݂�-�л�Q����z�m�\_נ�)�0�s".d�<��]�D����@�#%�j-2[�^/Wuy[_��(0���˻%���4e�&ʳ�X���ϳ+P��¥h�}w%m�2�Z�1�Y����yq�����F�.�F����jX'�"���.��TUl{�݇�U-���tCUJ��J�v?Q���"��Ibf�R3J�H��q$B�����To�qeqFeO�_���#[WA��f��^����C��1\�'�h�D/B�v��`]��7�ѐ�;ޟ�Rq�.7 fk��P\�Q�Yy3[������Ӝ܅��q��r}�+�~����h� ƚ"�MJ#tu�6�&�%�� ^s<]{8 w�~#;dS��=W>��D�(Ǘ��̵vP�C�:V"�:�+�y蛀ە�& DDS����#?J�2O&~�� »�/Jj�d�P�g�~ZZv�a�]�����N� ^����_��Qu ����I!� �}G*��Q,���^ � ���/��J�bf��!z���dx��$��i�';�e;;*�9��l�7cҾ����]l,UBF�+���~.ܬYc�ӑ�X�}Fź��]&���(wI�r'E�N��i�� |.����S(�> �GzD�F�~菴��Cp����� 2MwB6��$r��5&�h؈�:�7���U��n<[c{nV��Z���������8؉6ܖV?_8���NR���<��M:ђ�F8���4n��Ҋ�@�Y���V����r��������=lT�&7�s�,����u���o���i�BMW�"�MK�ׇ�e�����U���<�=���Z��˒�I9�!��<L���|vJ�i�Y����w�$��*��(���y#S��`���Ӄc ��-P�_�=��8TW��\�z���Tz\`#n��� �vt��w9���uS�is7�r$� ��V��(���*�\(�L����*F��.A�/�RԊ�;L.�hW�ja��3u�q���~�!`hfnpa��]�̷�'ݳM+�����5hd��߷$�tEr`�^�"�H�|-���?�d��w���"����N ���P�-o"�V���M��v����n��܀�߄����Į ���S:���:?)�I�jA:+�kU�&Tg�Ad���6�e��iHϡ0�K9-7$1���U����0��L�2�����b��L�4<��6=D��`+,�9N/�\�X7ل��k�xN1d�9^t�!�b�<h���R���.���g{��>�q93����w�|������,1��3��~�,^�r�ˮ���-x�jW�^ɣ�Hj�5���Q�c��j��C\vՇ�5t�д��h �3tδ����D�'qs+�=�iƚ��9� *i�ٻP��`���F�Du�r�ӳyUФID�(��A�:���T����!<m��A�`��eN*���`����P�k΅bmz��Վȭ��K� p��n֓Z�:�(r�Q\���tw����J��@��rs�f�d,~ LXXY�?\I���C���Q~S���:D�f�������I9��7`D���\6_`X�ŕD1 �V�WF��4�#��A�W �k�<V�>���͏9eT]�X� �Ӏ^�G��F�]&��a�8[�� �2��w����!���~<��T�q�v�W��>�1kn����~���`�����Mo�*��֫�L XamG{���lc!`Π�$O�V"�9�� )~�=M��r`}#s�z��2�����܉�f�T]� ,p�O)��Lx����s&� ��� u�f�T�0�GەBԿ�<횝��9�eu�;�s�5 ۿ��������q���o�M�&��2L�P ����C$�i)^]�K�j��/I-N�^��g��oz��G��d��U�Yv�$o4%�啛���C�_V�#Q����2��E�XQ��-�ڦ���]gO��9r��f�6y; �펦�-M���gϪq�]���p0�X�����!A�l�"9w�;���h�vDž9oxur��@wST��Y���lC�edl�v�љǑ��H�P�R#]KEJ"�|���1�O= !C�� ,���$ٳ䡻��ʪ��.��7�a�����E�k� �цs�{�^"��DD�aO�����_|jd.�� �N,-��m�E)�iG�a���T�3�!���5xF&y < __L�հ�K�4��$���u����������A�@��z'҇�ȖIX�ԺI�A^��M�� "6����c�1\��i9��^���kG��1�4���Ĉz�j��iTǵ�<��H�+{�� x�^xy��F�|8�}e��ڐ���UL~qD���� �.�B�]�'�?:�Y�4C]x2֭ۍ����m]����lD 7�����-.�=b�9$�Y¿&��rF�Q���gX���� K��x��Q�R0�_�E����Wu7dw"���i�������8(*�ݡ�F\ar����� t�dM1�!�| FN7'Irk�����z�7]^����&����1��̐>�k����Z>�)�����7xyy����r���n�_���,C����ض���a.i>������乓��c�Y_t%���U0gay�l�Nw%���!�$�$���4��n�Oo��\�h�Ѝ��=y;B��4�$�^i�"�[A!�� ���������$b�8g�'�SU�-l���1(6Z����1�g^g/V@�1��$Xm��� Y������Ú�G��w;1�[���k~�? Ud��x���6�x;�bXF�y8���E)3�'ƝJ��(����e�"<��g���j��EU(�Q�7E��we�RWd��ކٕ7Y9��nZX��.&�6�7��;\�|P�L��R��0D��;s����� ���w.�/�7���̯�}�U�֣�����{�5cA,�����h��>���X���:*�V0ߛ���4�� v�Y�u��#ެ�p����H��i��+,v4J�R�Y�}s�n\LG��OĬwVŌi�A"-�(ԇx[˜ ��@�BR�kڌ��{Ү���Wv�h��8�{��e��= d�ֱ$lBwr<ٚ�1;�+m��t�`z��ke}X�ś�� �H�1�݅}�.�9� ��k�V����a�����3ߍ�L��3z�����̒yKs>�I8���<��R����1��҉>Q�9�Ǔ���
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PWS.RisePro.156.1977.119.exe
Resource
win7-20240419-en
General
-
Target
SecuriteInfo.com.Trojan.PWS.RisePro.156.1977.119.exe
-
Size
3.0MB
-
MD5
ae030241b1eb74cea3112402cd2d43cf
-
SHA1
aa7a8af9cf01682ec0d484ca3b0b2d0953c52de0
-
SHA256
a59b2a8820e992d55b3ca8b289e26b0c6e66e75146df9565ff1ffcf8ccb47f3c
-
SHA512
83cd6bb4b23893beb4de2ba7807e36ae7d2c195b8a1d3b22d7824830435d2d2fb321636eb18e7fb41dbead68ebd8f6f5e22d26d61579064902a5adf615aac245
-
SSDEEP
98304:13LEPCOETk4irZ8nYkGUOnwmUcfWHgEc2P:17BlIZ8ndU1WAU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.Trojan.PWS.RisePro.156.1977.119.exe
Files
-
SecuriteInfo.com.Trojan.PWS.RisePro.156.1977.119.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 591KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 64KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE