afd10a19f1d15fdcfddb4cfafbcf63a2916dcc4a4a7c4cca8416dfd27338251e

Sharing

Copy URL Twitter E-mail

General

Target
Rise.rar
Size 37.7MB
Sample260630-qnls8sf14r
SHA256 afd10a19f1d15fdcfddb4cfafbcf63a2916dcc4a4a7c4cca8416dfd27338251e
MD5 522b4a128932b8ec389f9de4492b9573
SHA1 9ad6af8915e1f73bc4794905c90c9d5bce3290aa
SHA512 a59c9cb5efb821a3a7e9a3c42b6c1b383b4370f11b7275122a42cf2d8f892564502f591dcc7114a22395583b25a5c05b73f058340519f78c3d59b7d86e3be0ba
SSDEEP 786432:Sx+dY+5KtFP12dt0YMMZGbLau+gGCZkVchrdW2AXKy:Sx6YSjaBMZEa7vahH2Ky
TLSH
T1B3873305EF80E75FF98A5603D8133D4D9DCA422E17462AF6E4D49E8527EF1064EE0AEC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Rise.rar
- Size 37.7MB
- SHA256 afd10a19f1d15fdcfddb4cfafbcf63a2916dcc4a4a7c4cca8416dfd27338251e
- MD5 522b4a128932b8ec389f9de4492b9573
- SHA1 9ad6af8915e1f73bc4794905c90c9d5bce3290aa
- SHA512 a59c9cb5efb821a3a7e9a3c42b6c1b383b4370f11b7275122a42cf2d8f892564502f591dcc7114a22395583b25a5c05b73f058340519f78c3d59b7d86e3be0ba
- SSDEEP 786432:Sx+dY+5KtFP12dt0YMMZGbLau+gGCZkVchrdW2AXKy:Sx6YSjaBMZEa7vahH2Ky
- TLSH
  T1B3873305EF80E75FF98A5603D8133D4D9DCA422E17462AF6E4D49E8527EF1064EE0AEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  RiseCrack/Rise.jar
- Size 28.8MB
- SHA256 fddb9f41e0b08cba2e4f8d85331ac127b0d0ace632fba10c77c1145d3f05c199
- MD5 c9d2785b197e3d7fae0951dcdc137fb9
- SHA1 dc39b8dc217839067c48cd631c900bb20589464b
- SHA512 06ca073a98190cfb852bdf384db45b7d736e0ce55d98ceca0029dda5c7e2aff54e19de0cccc163034409a546a28737dabcb4d6c1d1aa5e11de6c8bd099406eeb
- SSDEEP 786432:0d4IfsuuubE1Y2hJhd+xC7Vb81KcL9Cdk4Z2D:0XsfXvT+w7VbBf5C
- TLSH
  T1B3671354B9BF9968E45FD23A45759063E4248BBA9E08B1FF327548887DECCC04343DBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  RiseCrack/Rise.json
- Size 26KB
- SHA256 f712f16792edb232a5ec48b7e48cbbb0dacd2dc9c1d740e8de02d8aee0dfd995
- MD5 266e78a95563ce8e1b5cc50f11bda241
- SHA1 02df66fce6a161af96bc152c807e55f75fa5b0d3
- SHA512 b00bb7de4fbff14d9df5dee1fab3a5eeea74eb6b9cae1c3f27cd1b3da70f4e040ee9b7fcdd7a2cea5abac21140ba5bbd6c8850bf18d3dd0e43c88939b16a7df8
- SSDEEP 192:WG9DNqDqVb1bYhUpd1tRAfArZyOS8meHkECWrv4v07QDjQYzdo7lnqdAs6hP4M:WGZb1bYhUpd5WSfmeHxyYdP4M
- TLSH
  T171C2FD77CD646E2B1BB6A2A2957A1306F83507AB458589DB397C018CFF768C26300F39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  libraries/com/google/code/gson/gson/2.9.0/gson-2.9.0.jar
- Size 243KB
- SHA256 c96d60551331a196dac54b745aa642cd078ef89b6f267146b705f2c2cbef052d
- MD5 53fa3e6753e90d931d62cb89580fde2f
- SHA1 8a1167e089096758b49f9b34066ef98b2f4b37aa
- SHA512 13ff22a60ee6a72ba0c4e8fe3702b8f3f6be6b67ed4279079a9843f57ad0ca125d4ecc1564ac4e736eab10fb6254d2c011b2c08c514d708be7f8091332ed2c2c
- SSDEEP 3072:Jxr2UermYIgPRzSEi1Y+FKyRoaq9vK0VO+4CtIoASpvk68jfLImcpqc0oSF9:ryrmnAFeir4aKhUIoAcs6OfLINq9
- TLSH
  T1ED34BE67E4980BEED99FCC3B01404423B994E5EA818FB65F15B091C548E3ED86F193EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  libraries/com/google/guava/guava/19.0/guava-19.0.jar
- Size 2.2MB
- SHA256 58d4cc2e05ebb012bbac568b032f75623be1cb6fb096f3c60c72a86f7f057de4
- MD5 43bfc49bdc7324f6daaa60c1ee9f3972
- SHA1 6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9
- SHA512 834f2bf4a5b35edffde0263409649aeaf34ca9a742ba511a06bb9b01626f9e774d2d3c8ba91a7905929dc8cd5e6471de29f7d0ab10260ece2af709b7fdbe4bc3
- SSDEEP 49152:WxSsfa7OLlXSAOeNa0slulorabWNmlZidRX5mU1sd7uGYebmY1e1:g4OLsAOeNM4OabcmlZzyh
- TLSH
  T137B5D0D73EE8D93AFF8BD9330061B1B93C594B689006789711B825A548A3C5D0F46BFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  libraries/com/viaversion/viabackwards/4.1.1/viabackwards-4.1.1.jar
- Size 847KB
- SHA256 ee5c46fec1a9be10843991b6696d34073feb42d752fc3a951d3180da2b8091da
- MD5 a26f34ecfad43dd89bf335dcb23b05cb
- SHA1 8313d5846bdf175dfb612f4f1cb38beaf5d5b073
- SHA512 8ba35a498454a6639fdb26690ad9f8251fde15a8a413f2cd85853c9b4c0dabe5bd02dbf93ffab79f085858945ee2389777c0b8ac0cb2a14c1b441801177644fa
- SSDEEP 12288:GX389fYivT7eZ8AYSGUtjPP6XHRbsno/GtpA1CFSeU857tkhk7c:6ib768NSf1PPSVsnjtT57tSko
- TLSH
  T1B2059E12B48AF7BDD8E102FD8E64F525BFED5CA4E1D30020B854F087355AD4AAF2562E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  libraries/com/viaversion/viarewind/2.0.3/viarewind-2.0.3.jar
- Size 449KB
- SHA256 2003c2174aa51a8ab6b86620b5f5df26032a22b9e80bdb3b88667f155dcf7eb2
- MD5 e46528e1ab574cf75f19feec1dad7f64
- SHA1 b8ce998873b613f8599490f4f6d443d532ea3677
- SHA512 218b7b8ae6a26afae6379ad71d4d7e1eabb69bdf4167fb2c3823411838e68a9c0d2d96c9cb5f8836721f5d289008be4e78b3be2df20e5669983679863ad859d5
- SSDEEP 12288:oNI7Tp5cwguSYGMAkh3h0CPDPXAR4Y3TPQ/MyHR3:yIJuwguU8R0Co4Y3uM4
- TLSH
  T193A48E06BD8E93FCD0BA583845687053BF0C9189E0D69115B9A2D44B34DAE97FB02F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  libraries/com/viaversion/viaversion/4.2.1/viaversion-4.2.1.jar
- Size 5.2MB
- SHA256 0c12a37d265c306ebe7e952773cf67aaea9025c8c485beeb3bb071ce4994dd5c
- MD5 d766f166f6614023f5fddd6d18ad2335
- SHA1 ee126cfcfa81c183279e1fb80468a65f7b1ee930
- SHA512 13d5ef1433ca71c820eeca90c43a64386b1a54ed83db43c235872fdc703175846d1fc432e630595db38ab2e10d11a8bb68b32a7f7e7592ecf796fee672e809f6
- SSDEEP 98304:UvjDjWtE9dIL+7gOjxkoqAfEKGU3wCypz2MT7Ec6dDWR35:UvjDqtEcKgOjxkoqAZTgCsisvJ
- TLSH
  T19046BE13BC8AD57FEDA613F645607022BB3D88E8D0D6552038A4B49E372DD4EAB3163D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  libraries/fr/litarvan/openauth/1.1.2/openauth-1.1.2.jar
- Size 37KB
- SHA256 9b08c3130aeba861d771e8865d29e44c709497e615a0d8007f7dabad1100573d
- MD5 fcb1fc26f0d0ab789bd630f8e8bf2eb8
- SHA1 1bc4a848960d8c2281614fd727741750026ff169
- SHA512 e3568bfac2cea50bdd18b163ac5143a2111d1ea8104bcf4a2750740b20a46b3b2db33b1493aed67f4889d1af1e5d5a1721a96e80e3573171f9b7a79e21001114
- SSDEEP 768:qpuk9rFa0CKyq0jFNFtYz6prevga8Q29K0RVJzUfTPN/4gK:tk9Ba0fCjA0evga8QERVRUNvK
- TLSH
  T143037D15D5A96832DE35F775D7320B083C3E27DAE11B54240EAA9286BE2794CFB0613B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  libraries/io/netty/netty-common/4.1.75.Final/netty-common-4.1.75.Final.jar
- Size 635KB
- SHA256 2f987b3562dfc471ed8b02c4a9222300293f1b6fd5efda6f438b6021da68ccd6
- MD5 f41f6850c8fb797a032abd97ddcba35f
- SHA1 84c32aa0e36b450d739c25576f5185e3ab9e7f66
- SHA512 37df09a18544420990f9340fa09c85f60b9cc1f02d5f11cfc6899a31deed2cf8b6886eb5d3dc8186e33c19b7f8a76669fa2eba1bacb295977e19c21133521d35
- SSDEEP 12288:DYR5p8BAIGmWIHAOPf89V7tfOm7zy6SY4Gy6iQIN2XzLYXzM:C8WINL2TtfTvyxYU6Z3X/YXzM
- TLSH
  T165D4CF277EA68674E953B03000528223E41C89E5F74BD49711E41FE5DAF9CC68BB6BCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  libraries/io/netty/netty-handler-proxy/4.1.75.Final/netty-handler-proxy-4.1.75.Final.jar
- Size 23KB
- SHA256 fbdec2fd71eff3b47bf88730f819154b23cae9cfc5ce2e00fd222612482dda93
- MD5 d1dc67ec9848923d49476c55635bcd21
- SHA1 f843662597aac6eab5ff54e21e528561bbff9b5b
- SHA512 a23abd1b9cf34f65779dd1df9d4c3ae10cb4cf976981e1c83a68386b12570e8bc1dc0f6ac64dfa890d7c1ecaa5b37ba611882aebf01e537cd2e8e51187b145e5
- SSDEEP 384:1KVTmTvPcYPz6zKtlzgfw0qMbcpdTnibjiWxl1mmV36B:fUYb6mtKVb+dTibjVJmmV36B
- TLSH
  T15FB2AD7EE5585234D33E51B0D0219143F43A88C4A74BA9C357A166133EF8BD1BEB2ED9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  libraries/org/apache/commons/commons-text/1.9/commons-text-1.9.jar
- Size 211KB
- SHA256 0812f284ac5dd0d617461d9a2ab6ac6811137f25122dfffd4788a4871e732d00
- MD5 c1c130c369aa86bfe4f7a7a920bc0223
- SHA1 ba6ac8c2807490944a0a27f6f8e68fb5ed2e80e2
- SHA512 ad39787c96445737904e343593c03aa4c4e76bd1516ff45e70fc1efd8a53439b1b104c3b0fed4e431d9291ebabf4bff2e5547e0c6510f59160b8ea620bad2ae2
- SSDEEP 3072:GSvPTkmFjZuiY0VUJ5Ll9j0kwvA6VksCHpgEBu4qY0JSGu5OWACJ59lQGGZN:hjkOZuv4kwvAAEgEgFYcu5LACwGGn
- TLSH
  T1D124D025A4D74834FE3391788AD239C7B47FE748D29BB4D930EDF243946998426EB384
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  libraries/org/projectlombok/lombok/1.18.22/lombok-1.18.22.jar
- Size 1.9MB
- SHA256 ecef1581411d7a82cc04281667ee0bac5d7c0a5aae74cfc38430396c91c31831
- MD5 30905901647fe0ebb06fb20ee8a638bf
- SHA1 9c08ea24c6eb714e2d6170e8122c069a0ba9aacf
- SHA512 38016486e19ede88ff0c32356935c9ad11d6bdd88894016db6a21c31cf68e73c6caf05504cd7148759d9bca5152f6068be2d6d26938f0f329ed9085084f1d984
- SSDEEP 49152:lTtzs1QNHH+5hkoyIlLpBiQArBd+sKqlOK9b:74iH+kovdpBqNOqL
- TLSH
  T1AA95F066D0DD9CB1F1321A37996978F33B3E035CCE07648A39696192ED36A4C8F0F11A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral13
- Target
  libraries/org/yaml/snakeyaml/1.27/snakeyaml-1.27.jar
- Size 302KB
- SHA256 7e7cce6740ed705bfdfaac7b442c1375d2986d2f2935936a5bd40c14e18fd736
- MD5 466ff09da784f9f21b2e6bf3b486a8cd
- SHA1 359d62567480b07a679dc643f82fc926b100eed5
- SHA512 354478c28b49c7588a90c719c143c4690d4a81adf25e05635fa8a048bfb007d2f1b1812ed6e96b0f17f94f3fbac2c49fb6e94f27e34fa09ed9803f5dbf342b9f
- SSDEEP 6144:diaFgjlI/yJghcvWReGHcZsqQF5C652d6B8Pq4oLjVkHM3YxCnPJrV0I0tl:vFgjlYFhcvtGcabPNkHmYxqb0I8
- TLSH
  T1D264CF19BEB6F96DE793A1B408C3841368287386B2C9E21705E407E9CC65C4517EFBDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14