Extracted

• • Target

    Loader.exe

  • Size

    5.5MB

  • MD5

    10614cf2f1776ac3cdde30d497897c72

  • SHA1

    91c441810fee12a4c04e33649c590c33a3bd1427

  • SHA256

    18ed1ce822016af6ad90ba47dd82f0848837d7b047eb019af2518877469f494e

  • SHA512

    3dfab245a2e9818c0a86ccc7f85d09aad954e7194b193e361f1386bd5023fd94ebdf616233eefc84b6f7af49c9484bc6f82a84a77188e9d828153df9ad197e46

  • SSDEEP

    98304:jAxZzZlTxAhUIFzK1U1cmQGb9QgfRRG0kNjNP2AQIJqv:jUZtlKhUIFiUpQKmgf8BP24Jqv

  Score

  10^/10

  risepromicrosoftcollectionpersistencephishingstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Drops startup file

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detected potential entity reuse from brand microsoft.

    phishingmicrosoft

  • Suspicious use of SetThreadContext

  behavioral1