Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c1f1cf31b00486213e9342bfc8eb1b3f83775a419248a22de799450fab0ecfe3

  • Size

    2.4MB

  • Sample

    240524-bzzrxage4w

  • MD5

    c31c3f1909dab9a03c3f59a8bd555b38

  • SHA1

    35b649010e2d596e9147ebe995176ef8ef7bc539

  • SHA256

    c1f1cf31b00486213e9342bfc8eb1b3f83775a419248a22de799450fab0ecfe3

  • SHA512

    aed44e6b0ad9007d40248a6c114f8220e2bff5177c5aa0e71a8ce42ce9aa19f54b342270be9abf6ff2f89770b8993af4fa0c2b034eb1bc692346c830b1cc8fa7

  • SSDEEP

    49152:yfNYyhPNfMGphcnhnsvpWvD9PJREkkvGJ9ickAacAH1e3/Zc+mhlS4fs0m:8XWaxWbtrEGJBk5BH1+x96S+

Score
10/10
riseproevasionstealer

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Targets

    • Target

      c1f1cf31b00486213e9342bfc8eb1b3f83775a419248a22de799450fab0ecfe3

    • Size

      2.4MB

    • MD5

      c31c3f1909dab9a03c3f59a8bd555b38

    • SHA1

      35b649010e2d596e9147ebe995176ef8ef7bc539

    • SHA256

      c1f1cf31b00486213e9342bfc8eb1b3f83775a419248a22de799450fab0ecfe3

    • SHA512

      aed44e6b0ad9007d40248a6c114f8220e2bff5177c5aa0e71a8ce42ce9aa19f54b342270be9abf6ff2f89770b8993af4fa0c2b034eb1bc692346c830b1cc8fa7

    • SSDEEP

      49152:yfNYyhPNfMGphcnhnsvpWvD9PJREkkvGJ9ickAacAH1e3/Zc+mhlS4fs0m:8XWaxWbtrEGJBk5BH1+x96S+

    Score
    10/10
    riseproevasionstealer

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

      stealerrisepro

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks