Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

9

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6e40ca34eb6811618ebbb7a4bd439b1a12ca112f82f399c653a1e04f332d018b

  • Size

    2.3MB

  • Sample

    240526-qn1mdsgh76

  • MD5

    666067beec610b8d100c77d70c7ef968

  • SHA1

    afa0dc00d7c4747bbbda980d2eaf1f099375a5a3

  • SHA256

    6e40ca34eb6811618ebbb7a4bd439b1a12ca112f82f399c653a1e04f332d018b

  • SHA512

    d5bca238830bb5b91fc1e2ab0a87d14bce41c04c7afdd875cc2bc4920aeb3445aabd67e1817465e7a6dd51d1147ff8d00b3cb5142ee9a7859df3fceadb907371

  • SSDEEP

    49152:skmKhyq24kI3qebVseXKiAjkrrMulNvsS5Ln+nQL/d:skmKEqlkAbmeXKiA41lNvswLsGV

Score
10/10
riseproevasionstealer

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Targets

    • Target

      6e40ca34eb6811618ebbb7a4bd439b1a12ca112f82f399c653a1e04f332d018b

    • Size

      2.3MB

    • MD5

      666067beec610b8d100c77d70c7ef968

    • SHA1

      afa0dc00d7c4747bbbda980d2eaf1f099375a5a3

    • SHA256

      6e40ca34eb6811618ebbb7a4bd439b1a12ca112f82f399c653a1e04f332d018b

    • SHA512

      d5bca238830bb5b91fc1e2ab0a87d14bce41c04c7afdd875cc2bc4920aeb3445aabd67e1817465e7a6dd51d1147ff8d00b3cb5142ee9a7859df3fceadb907371

    • SSDEEP

      49152:skmKhyq24kI3qebVseXKiAjkrrMulNvsS5Ln+nQL/d:skmKEqlkAbmeXKiA41lNvswLsGV

    Score
    10/10
    evasionriseprostealer

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

      stealerrisepro

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks