Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d0557d1508baa5a759b75ec549e77b5cbe924f25c4ad3be7a3fe55785018044a

  • Size

    2.3MB

  • Sample

    240527-jv8s1seb25

  • MD5

    bb9d0873c59e7c04316586f2ec66c6bf

  • SHA1

    ef6b0685ed8cddcd7bfaea7ba1b19e8f3d26e48b

  • SHA256

    d0557d1508baa5a759b75ec549e77b5cbe924f25c4ad3be7a3fe55785018044a

  • SHA512

    937a102182ed66eeeeb65219d789dcc173b61b0b27a2e00dc7586eec484aee71f80a470125428e4b28fed2152a509a1aac64271ee6414b0138c4bf7b38e078f5

  • SSDEEP

    49152:g8FBz0POahtQPd5+44iIvwjJPWjYm8V4lH8wLA:gI01htY+7fvkFgHQ

Score
10/10
riseproevasionstealer

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Targets

    • Target

      d0557d1508baa5a759b75ec549e77b5cbe924f25c4ad3be7a3fe55785018044a

    • Size

      2.3MB

    • MD5

      bb9d0873c59e7c04316586f2ec66c6bf

    • SHA1

      ef6b0685ed8cddcd7bfaea7ba1b19e8f3d26e48b

    • SHA256

      d0557d1508baa5a759b75ec549e77b5cbe924f25c4ad3be7a3fe55785018044a

    • SHA512

      937a102182ed66eeeeb65219d789dcc173b61b0b27a2e00dc7586eec484aee71f80a470125428e4b28fed2152a509a1aac64271ee6414b0138c4bf7b38e078f5

    • SSDEEP

      49152:g8FBz0POahtQPd5+44iIvwjJPWjYm8V4lH8wLA:gI01htY+7fvkFgHQ

    Score
    10/10
    riseproevasionstealer

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

      stealerrisepro

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks