risepro | MBSetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MBSetup.exe
Size 2.5MB
Sample240611-tbv3xssdpc
SHA256 b9ee60f31be0b7dc3f814c8abbc7caacb6a3e1dc7eb1504b8e831dd42277f8d8
MD5 4e19e70399076ab58d1160d0fa2664ec
SHA1 e7ca7e0f1895c6bf60a14d6fbb0ccd4fb10a3134
SHA512 f6338b52cb5a80d960e6b1ec72a28538614782a75d0270cb89e911160c0a0e8e3a4d0f93fb902c70c37cc5f4da0529043776e2c0b59287096f976addb7e584d8
SSDEEP 49152:6VCZ7CYG91YEzNIbd18dStQyfvE0Z3R0nxiIq2dd0ZyWmX4:eCZ7CXQEzNwABKtQRq2RX4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Signatures

Risepro family
risepro

File Explorer

MBSetup.exe

.exe 2.5MB

MBSetup.exe

IMPHASH 63ccd71a76a39a85385ce6d1810f26c1
SHA256 b9ee60f31be0b7dc3f814c8abbc7caacb6a3e1dc7eb1504b8e831dd42277f8d8
MD5 4e19e70399076ab58d1160d0fa2664ec
SHA1 e7ca7e0f1895c6bf60a14d6fbb0ccd4fb10a3134
SHA512 f6338b52cb5a80d960e6b1ec72a28538614782a75d0270cb89e911160c0a0e8e3a4d0f93fb902c70c37cc5f4da0529043776e2c0b59287096f976addb7e584d8
SSDEEP 49152:6VCZ7CYG91YEzNIbd18dStQyfvE0Z3R0nxiIq2dd0ZyWmX4:eCZ7CXQEzNwABKtQRq2RX4
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

86:6a:d0:4b:f2:07:92:9d:30:a6:23:92:2b:58:30:08:d5:03:9d:63:fe:45:88:60:c8:61:e5:a9:f9:ed:45:dd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Chains

May 16, 2024

Digest

86:6a:d0:4b:f2:07:92:9d:30:a6:23:92:2b:58:30:08:d5:03:9d:63:fe:45:88:60:c8:61:e5:a9:f9:ed:45:dd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

Chains

May 16, 2024

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

Serial Number

a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2022 - Mar 16, 2025

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 1, 2010 - Jan 18, 2038

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Serial Number

33:00:00:ff:25:2a:16:2a:a0:f2:08:95:9f:00:00:00:00:ff:25

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 16, 2024 - May 19, 2024

Subject

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Serial Number

33:00:00:ff:25:2a:16:2a:a0:f2:08:95:9f:00:00:00:00:ff:25

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 16, 2024 - May 19, 2024

Subject

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

455117

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\A_MB5_MBSetup\bin\Win32\Release\MBSetup.pdb

kernel32

LeaveCriticalSection RaiseException EnterCriticalSection GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSectionEx DeleteCriticalSection IsWow64Process GetCurrentProcess VerifyVersionInfoW VerSetConditionMask GetSystemDirectoryW CreateFileW DeviceIoControl CloseHandle GetCurrentThreadId SetLastError Sleep DeleteFileW GlobalFree LockResource FindResourceExW LocalFree FormatMessageW LocalAlloc CallNamedPipeW GetWindowsDirectoryW SetCurrentDirectoryW GetCommandLineW lstrcmpiW CreateMutexW GetNativeSystemInfo GetDiskFreeSpaceExW FindFirstFileW FindClose CreateProcessW FindNextFileW WideCharToMultiByte GlobalAlloc GlobalLock SetThreadUILanguage LoadLibraryW CreateDirectoryW GetLogicalDrives GetTempPathW MoveFileExW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList OpenProcess ResumeThread TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentDirectoryW GetCurrentProcessId GetModuleFileNameA OutputDebugStringW SetEndOfFile WriteConsoleW SetStdHandle GetProcAddress GetModuleHandleW FreeLibrary GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy DecodePointer MulDiv SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW FindFirstFileExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle RemoveDirectoryW AreFileApisANSI CopyFileW DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread QueryPerformanceCounter TryEnterCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA GetVersionExW ReleaseSemaphore InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitProcess GetModuleHandleExW GetCommandLineA ExitThread GetStdHandle WriteFile GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetFileSizeEx GetDateFormatW

dwmapi

DwmGetWindowAttribute

crypt32

CryptMsgClose CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CryptQueryObject

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

Sharing

General

Malware Config

Signatures

File Explorer

MBSetup.exe

PE Signature issue

kernel32

dwmapi

crypt32

rpcrt4

generic