Extracted

Extracted

• • Target

    RisePro_Stealer.zip

  • Size

    132.3MB

  • MD5

    f3f75e768b2f9ce2fcea5b13a4359fd5

  • SHA1

    298cceaacb6d32a2999eb0e70bcc1b5fa6dd1e71

  • SHA256

    835660cab66991d746aec86d76a04554f4e37b0c2130b0a8c11cbb34d824c408

  • SHA512

    6cbad6270f74a51a4cd6d4a08fffd5c75e123bc26edbba44c3e87bce4996bada3d9f914271d9436a9254d91b74721a4a1eb2d3b7387c726491abd7d05ba13694

  • SSDEEP

    3145728:y0r5qDHbowmPqvPiszd66UEebXFf2Vo88SZdN2Ath69RXc4ydZVdyH:H4Dbowmq3fdvgOS88Sxn4c4yDyH

  Score

  10^/10

  gurcuprivateloaderriseproxwormdiscoveryevasionexecutionloaderpersistenceprivilege_escalationratstealertrojan

  • Detect Xworm Payload

  • Gurcu family

    gurcu

  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • Privateloader family

    privateloader

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Risepro family

    risepro

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1