General

  • Target

    d21dbfef87407263a0f22c099a1d8b59a14267b9523463ee91b261fc3e046acc

  • Size

    2.2MB

  • Sample

    240603-kbt17aac95

  • MD5

    1de07a0c44239e14342f6bf02e5bd091

  • SHA1

    193160495ec9e9dbeded1b7c34bc8ccf517d6d26

  • SHA256

    d21dbfef87407263a0f22c099a1d8b59a14267b9523463ee91b261fc3e046acc

  • SHA512

    ec21a0ee388dd4959839f0a69e15dd7a3ed6d42b0d33718e2767e7dfe9f4ac651508da508a266d7bd6cb7fbffb9cc7b65a1e9c1c2bea11ca8335963df6144e33

  • SSDEEP

    49152:okmKhyq24kI3qebVaebcpqYwvxeKvHN31vxfOmzuRf8R55OdTF:okmKEqlkAbkOp5vtlgsU+55O

Score
10/10

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Targets

    • Target

      d21dbfef87407263a0f22c099a1d8b59a14267b9523463ee91b261fc3e046acc

    • Size

      2.2MB

    • MD5

      1de07a0c44239e14342f6bf02e5bd091

    • SHA1

      193160495ec9e9dbeded1b7c34bc8ccf517d6d26

    • SHA256

      d21dbfef87407263a0f22c099a1d8b59a14267b9523463ee91b261fc3e046acc

    • SHA512

      ec21a0ee388dd4959839f0a69e15dd7a3ed6d42b0d33718e2767e7dfe9f4ac651508da508a266d7bd6cb7fbffb9cc7b65a1e9c1c2bea11ca8335963df6144e33

    • SSDEEP

      49152:okmKhyq24kI3qebVaebcpqYwvxeKvHN31vxfOmzuRf8R55OdTF:okmKEqlkAbkOp5vtlgsU+55O

    Score
    10/10
    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks