General
- Target RisePortable.exe
- Size 357.6MB
- Sample261102-gr1xwsfs3v
- SHA256 b9b44d5d0d5d82e295c7fda1fd319c303166680febb1ea7c823bc88fb49a5b73
- MD5 a75f426179aa0989d7dcac2a4bb8283a
- SHA1 610b2db4adce2267702446b36193ad31ed1087c7
- SHA512 5892f4b5617ab546ba427cca584af2820ec9aa022dfe10add3f5c50eb7635682ad0e6ed06fe358487c4ef6b4ec0c86e17527aae2ea548671d79c4d2da4ed1ab2
- SSDEEP 6291456:cgHPVOOSM4DZW1Lro6BafbHgD10HbWVPLhUGovDuFBvqHCwvdFJ5vjuJOLuCi++0:cjOSMGZW1Ls6BPDHPlUGoCjqHbv+6l
- TLSH T135093398F0528237D166B37225B09AD5B7301D42B141E6AEF9D793D133A67C21BE2F0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RisePortable.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
RisePortable.exe
Resource
win11ltsc2024-20260911-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target RisePortable.exe
- Size 357.6MB
- SHA256 b9b44d5d0d5d82e295c7fda1fd319c303166680febb1ea7c823bc88fb49a5b73
- MD5 a75f426179aa0989d7dcac2a4bb8283a
- SHA1 610b2db4adce2267702446b36193ad31ed1087c7
- SHA512 5892f4b5617ab546ba427cca584af2820ec9aa022dfe10add3f5c50eb7635682ad0e6ed06fe358487c4ef6b4ec0c86e17527aae2ea548671d79c4d2da4ed1ab2
- SSDEEP 6291456:cgHPVOOSM4DZW1Lro6BafbHgD10HbWVPLhUGovDuFBvqHCwvdFJ5vjuJOLuCi++0:cjOSMGZW1Ls6BPDHPlUGoCjqHbv+6l
- TLSH T135093398F0528237D166B37225B09AD5B7301D42B141E6AEF9D793D133A67C21BE2F0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.