risepro

General

Target
d0eff53cfd30f061451987b4e98205d81f9495e8f26def46aec15f7a4c171c20.exe
Size 3.1MB
Sample240621-bzzrxavdqa
SHA256 d0eff53cfd30f061451987b4e98205d81f9495e8f26def46aec15f7a4c171c20
MD5 de584dd4970a8099454611ee0c739ea8
SHA1 f22fe3bfb22b55d1f0dc2fd802a32d2beb157e0b
SHA512 58470ab84c35022860036cb5dfdccec9bb1f1ebea37e4745efc70c464e2ffb9b9835a1251cdf76c012f56dd0a72a4d448b0ac298da02f4676ebcccc03b2a0b76
SSDEEP 98304:t+VDlD+ah2X5f2CiioP8peU/Ju4+iU2lfOZy81+1l:AnZYuTcRxuZiUiW9+1l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

risepro

C2

77.91.77.66:58709

Targets

- Target
  d0eff53cfd30f061451987b4e98205d81f9495e8f26def46aec15f7a4c171c20.exe
- Size 3.1MB
- SHA256 d0eff53cfd30f061451987b4e98205d81f9495e8f26def46aec15f7a4c171c20
- MD5 de584dd4970a8099454611ee0c739ea8
- SHA1 f22fe3bfb22b55d1f0dc2fd802a32d2beb157e0b
- SHA512 58470ab84c35022860036cb5dfdccec9bb1f1ebea37e4745efc70c464e2ffb9b9835a1251cdf76c012f56dd0a72a4d448b0ac298da02f4676ebcccc03b2a0b76
- SSDEEP 98304:t+VDlD+ah2X5f2CiioP8peU/Ju4+iU2lfOZy81+1l:AnZYuTcRxuZiUiW9+1l
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

risepro evasion stealer themida trojan
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Detects executables packed with Themida
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects executables packed with Themida

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2