Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a5cbfe211d574420560b50daed3e9e1dd553935c114359202a94f3d6c303c9bb

  • Size

    2.3MB

  • Sample

    240601-txjxsahc25

  • MD5

    c604b50e7f6202f93dc743770caa0c1b

  • SHA1

    cf91df2cd72901705cd68fc2561d239a42055672

  • SHA256

    a5cbfe211d574420560b50daed3e9e1dd553935c114359202a94f3d6c303c9bb

  • SHA512

    582dc0906e5be21ee1a4d6a0ba8cf56d6be7d9a4e617aa8f1ed97a01d79ffcbbae7328282fc477ee418f0065b065e602bb00ee753db4799dfc1eb77ea81a341b

  • SSDEEP

    49152:IkmKhyq24kI3qebVawjZcc4TJPKcX1Klz717D01OB5:IkmKEqlkAbkTc4FKcQVkO

Score
10/10

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Targets

    • Target

      a5cbfe211d574420560b50daed3e9e1dd553935c114359202a94f3d6c303c9bb

    • Size

      2.3MB

    • MD5

      c604b50e7f6202f93dc743770caa0c1b

    • SHA1

      cf91df2cd72901705cd68fc2561d239a42055672

    • SHA256

      a5cbfe211d574420560b50daed3e9e1dd553935c114359202a94f3d6c303c9bb

    • SHA512

      582dc0906e5be21ee1a4d6a0ba8cf56d6be7d9a4e617aa8f1ed97a01d79ffcbbae7328282fc477ee418f0065b065e602bb00ee753db4799dfc1eb77ea81a341b

    • SSDEEP

      49152:IkmKhyq24kI3qebVawjZcc4TJPKcX1Klz717D01OB5:IkmKEqlkAbkTc4FKcQVkO

    Score
    10/10
    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks