Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ad7b4598918c9f75bcad2d3837abc47e.bin

  • Size

    3.3MB

  • Sample

    240622-dzrgmswarh

  • MD5

    39e95dd0ac3b315d47ceef2f014f0389

  • SHA1

    f3828dc33246adf966a23dd4bbf806fc319e70ab

  • SHA256

    d5523864ef70c0e5fb27c3a6e80ce422fc3786a6a1203fbccf1c04ba1b819d06

  • SHA512

    10140e5b12998701a469cff3118c1df351cbcef3bd4c0a564e3db0c5d53536bbaa168216ce9105363892adaa5eea6c6da9b2faa810c7a9935c477efb5252649f

  • SSDEEP

    98304:ZVyhmpwtqxYxktZPhXHW7A+dC6qwWiqwiCpnIwU32R8yFLt3:ShmpEqcOPNMAXwWvwiCpe3U3

Malware Config

Extracted

Family

risepro

C2

77.91.77.66:58709

Targets

    • Target

      d0e3c511f4c02b9dd4130462ac716024ad29581a072a9095f40ac7c348c7ede6.exe

    • Size

      3.4MB

    • MD5

      ad7b4598918c9f75bcad2d3837abc47e

    • SHA1

      c216e887a2559bc45f4b75d8f97e8d2450f16213

    • SHA256

      d0e3c511f4c02b9dd4130462ac716024ad29581a072a9095f40ac7c348c7ede6

    • SHA512

      6de0d861f74e9710a3953ae2196a42dde9bee708ddaf40ee294abeeadab097b2e3fc9de1a21aa146f747c821af16d92c4cab94537833bf1bbd7396b315d9be66

    • SSDEEP

      49152:ustZbif3Y+7iIP/+luqThrrmOWEgersFUx3VDzjtwrbAzToGb+938BLgd4nOKUKj:3tkfH7Okq5yOjFF1iAz8M/OKmiGXq

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks