MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19e799b44a59412e8f9d66be8176fe6ee1fcd18ee7a740ce899edac3c2310639. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RiseProStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 10 File information Comments

SHA256 hash:	19e799b44a59412e8f9d66be8176fe6ee1fcd18ee7a740ce899edac3c2310639
SHA3-384 hash:	bd7d99dadc0bc6c8b889e8bd262f827a3188ef0ab06cd55404abe45649c692f4e3ff3b06e1c7cbd03639dde15abc80e0
SHA1 hash:	7921f5db13c23d8b52634c555ded56dc1e1fea44
MD5 hash:	b898305476b4cee57c98401819a84e57
humanhash:	pip-pasta-mirror-seven
File name:	b898305476b4cee57c98401819a84e57.bin.exe
Download:	download sample
Signature	RiseProStealer Create hunting rule
File size:	811'008 bytes
First seen:	2023-08-10 14:55:26 UTC
Last seen:	2023-08-10 15:28:36 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	8801a5787fb0afca6c87d6856306680b (3 x RedLineStealer, 1 x RiseProStealer)
ssdeep	12288:1HFO1RkVLivZtXEYJjotQE177mWAOxyCVQCQzlwGe8E5GG5vNIKegI475sZi9VJI:1FOUVGt0ztQE1v6Ox7VRQ5o8xcTQoK
TLSH	T1BF05F1C2AEE07C21F552CE328E3E86E7763DFD618E683B591168FA6F05710E2D162341
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	b233f8ccc4f4cc4c (1 x RiseProStealer)
Reporter	abuse_ch
Tags:	exe RiseProStealer

abuse_ch

RiseProStealer C2:
168.100.10.122:50500

Intelligence

File Origin

# of uploads :

# of downloads :

336

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

b898305476b4cee57c98401819a84e57.bin.exe

Verdict:

Malicious activity

Analysis date:

2023-08-10 14:56:41 UTC

Tags:

risepro stealer

Link:

https://app.any.run/tasks/718b067e-c7c9-4457-bddb-f9b4a30828b9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/441954/

Detection(s):

SecuriteInfo.com.Win32.TrojanX-gen.19526.6712.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Sending a custom TCP request

DNS request

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/19e799b44a59412e8f9d66be8176fe6ee1fcd18ee7a740ce899edac3c2310639

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/93b71bbf-c8d1-4b09-874b-0dcb6231f4f2

Result

Threat name:

PrivateLoader, RisePro Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1289458

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected PrivateLoader

Yara detected RisePro Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/19e799b44a59412e8f9d66be8176fe6ee1fcd18ee7a740ce899edac3c2310639/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2023-08-10 14:56:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dhtztncklfas5d45m27ic5x6n3q7zumo46tubtujt3nmhqrray4q._file

Verdict:

malicious

Result

Malware family:

privateloader

Score:

10/10

Tags:

family:privateloader loader spyware stealer

Link:

https://tria.ge/reports/230810-sa1fksfe3y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Program crash

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

PrivateLoader

Malware Config

C2 Extraction:

1.1.1.1

Unpacked files

SH256 hash:

67c7f971f69cbc839c0418dcac409d46b958fd1678763b530fc895fa43afd215

MD5 hash:

049c839f9ef2323055976858dde53040

SHA1 hash:

adf72a56e93deed1901757a0441d485a14408676

Detections:

RiseProXorStr

win_privateloader_w0

Link:

https://www.unpac.me/results/aa07e31e-e263-425e-8cee-9bab2ecda3ea/

Parent samples :

19e799b44a59412e8f9d66be8176fe6ee1fcd18ee7a740ce899edac3c2310639
25ef0f7912798ce382c529a802d817926761bb52450b2e7f74db7c7788fe6ca7

SH256 hash:

19e799b44a59412e8f9d66be8176fe6ee1fcd18ee7a740ce899edac3c2310639

MD5 hash:

b898305476b4cee57c98401819a84e57

SHA1 hash:

7921f5db13c23d8b52634c555ded56dc1e1fea44

Link:

https://www.unpac.me/results/aa07e31e-e263-425e-8cee-9bab2ecda3ea/

Malware family:

PrivateLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/19e799b44a59/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/19e799b44a59412e8f9d66be8176fe6ee1fcd18ee7a740ce899edac3c2310639

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	privateloader Create hunting rule
Author:	andretavare5
Description:	PrivateLoader pay-per-install malware

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

Rule name:	win_privateloader Create hunting rule
Author:	andretavare5
Reference:	https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service

Rule name:	win_privateloader_w0 Create hunting rule
Author:	andretavare5
Reference:	https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service