MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ba36d7b73dba1eaa3b706415ca0686a474ee1662cf6ad94708e987bb1400758. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RiseProStealer


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ba36d7b73dba1eaa3b706415ca0686a474ee1662cf6ad94708e987bb1400758
SHA3-384 hash: 5274276c7fab414e1b3b578b501a180211db23d9d2c7cd3556faddfe97965bbe357ffb8a0fd69cc2af92d308a0241d2a
SHA1 hash: 5ecdf5385b6eb7cb43fdda492f8443b868f84e8e
MD5 hash: eeec76a506c7bfaae3fe91bfae3e7bc8
humanhash: fourteen-pasta-july-princess
File name:SecuriteInfo.com.Win32.TrojanX-gen.16213.27246
Download: download sample
Signature RiseProStealer
Create hunting rule
File size:2'345'984 bytes
First seen:2024-02-02 14:24:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash baa93d47220682c04d92f7797d9224ce (139 x RiseProStealer, 26 x Xtrat, 18 x CoinMiner)
ssdeep 49152:Emo7zh//h7mL+FMNFbHow8hI/5gBKoE8zUiCqL/FxvQA03sULY:Wzh/JrMNdow8ySEOL/FxvQhcMY
TLSH T14BB533EA73B05251E407E7F8C65AA1252693BD1322D6FD00EBB4F96A8F3DDB1E508C50
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4505/5/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon cc31e8cccce833cc (116 x RiseProStealer, 1 x Amadey)
Reporter SecuriteInfoCom
Tags:exe RiseProStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
586
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/474201/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.16213.27246.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed packed themidawinlicense
Link:
https://www.filescan.io/uploads/65bcfb45b012cce0edb98372/reports/4bb515ff-ebdb-40f2-ab27-c7e4a2f104d9/overview
Verdict:
Malicious
Labled as:
Strictor.Generic
Link:
https://www.hybrid-analysis.com/sample/1ba36d7b73dba1eaa3b706415ca0686a474ee1662cf6ad94708e987bb1400758
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/0020b15c-37f6-4a33-9f8a-1502c426139a
Result
Threat name:
Amadey, RedLine, RisePro Stealer, Stealc
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1385641
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
Creates multiple autostart registry keys
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies windows update settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Potentially malicious time measurement code found
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Amadeys stealer DLL
Yara detected RedLine Stealer
Yara detected RisePro Stealer
Yara detected Stealc
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1385641 Sample: SecuriteInfo.com.Win32.Troj... Startdate: 02/02/2024 Architecture: WINDOWS Score: 100 89 secretionsuitcasenioise.shop 2->89 91 modestessayevenmilwek.shop 2->91 93 24 other IPs or domains 2->93 119 Snort IDS alert for network traffic 2->119 121 Antivirus detection for URL or domain 2->121 123 Antivirus / Scanner detection for submitted sample 2->123 125 10 other signatures 2->125 9 SecuriteInfo.com.Win32.TrojanX-gen.16213.27246.exe 2 113 2->9         started        14 MPGPH131.exe 12 2->14         started        16 MPGPH131.exe 97 2->16         started        18 9 other processes 2->18 signatures3 process4 dnsIp5 97 185.215.113.68 WHOLESALECONNECTIONSNL Portugal 9->97 99 109.107.182.3, 49735, 49736, 80 TELEPORT-TV-ASRU Russian Federation 9->99 103 2 other IPs or domains 9->103 73 C:\Users\user\...\yKPu2hey3IoyXSfEa3Cp.exe, PE32 9->73 dropped 75 C:\Users\user\...\x9xR3wK9W907iDwipOEa.exe, PE32 9->75 dropped 77 C:\Users\user\...\x1yIDdNN4CF6rAoBwwWi.exe, PE32 9->77 dropped 85 13 other malicious files 9->85 dropped 145 Detected unpacking (changes PE section rights) 9->145 147 Binary is likely a compiled AutoIt script file 9->147 149 Tries to steal Mail credentials (via file / registry access) 9->149 167 4 other signatures 9->167 20 x9xR3wK9W907iDwipOEa.exe 9->20         started        23 yKPu2hey3IoyXSfEa3Cp.exe 9->23         started        25 x1yIDdNN4CF6rAoBwwWi.exe 8 9->25         started        34 6 other processes 9->34 151 Antivirus detection for dropped file 14->151 153 Multi AV Scanner detection for dropped file 14->153 155 Machine Learning detection for dropped file 14->155 157 Potentially malicious time measurement code found 14->157 79 C:\Users\user\...\bAS0BLhRMLPLGvLG30xz.exe, PE32 16->79 dropped 81 C:\Users\user\...\H1daz3dJ0xxAdfJ_CEUe.exe, PE32 16->81 dropped 83 C:\Users\user\AppData\Local\...\niks[2].exe, PE32 16->83 dropped 87 2 other malicious files 16->87 dropped 169 3 other signatures 16->169 101 127.0.0.1 unknown unknown 18->101 159 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 18->159 161 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 18->161 163 Creates multiple autostart registry keys 18->163 165 Maps a DLL or memory area into another process 18->165 27 msedge.exe 18->27         started        30 firefox.exe 18->30         started        32 firefox.exe 18->32         started        37 2 other processes 18->37 file6 signatures7 process8 dnsIp9 127 Detected unpacking (changes PE section rights) 20->127 129 Detected unpacking (overwrites its own PE header) 20->129 131 Modifies windows update settings 20->131 141 3 other signatures 20->141 133 Tries to detect sandboxes and other dynamic analysis tools (window names) 23->133 135 Tries to evade debugger and weak emulator (self modifying code) 23->135 137 Hides threads from debuggers 23->137 143 2 other signatures 23->143 139 Binary is likely a compiled AutoIt script file 25->139 39 chrome.exe 25->39         started        42 chrome.exe 25->42         started        44 chrome.exe 25->44         started        56 9 other processes 25->56 111 bzib.nelreports.net 27->111 113 23.101.168.44 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 27->113 117 16 other IPs or domains 27->117 115 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 GOOGLEUS United States 30->115 46 firefox.exe 30->46         started        71 C:\Users\user\AppData\Local\...\explorhe.exe, PE32 34->71 dropped 48 conhost.exe 34->48         started        50 conhost.exe 34->50         started        52 conhost.exe 34->52         started        54 conhost.exe 34->54         started        file10 signatures11 process12 dnsIp13 95 239.255.255.250 unknown Reserved 39->95 58 chrome.exe 39->58         started        61 chrome.exe 42->61         started        63 chrome.exe 44->63         started        65 msedge.exe 56->65         started        67 msedge.exe 56->67         started        69 msedge.exe 56->69         started        process14 dnsIp15 105 clients.l.google.com 142.250.105.101, 443, 49738 GOOGLEUS United States 58->105 107 youtube-ui.l.google.com 173.194.219.190, 443, 49740, 49752 GOOGLEUS United States 58->107 109 9 other IPs or domains 58->109
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1ba36d7b73dba1eaa3b706415ca0686a474ee1662cf6ad94708e987bb1400758
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ba36d7b73dba1eaa3b706415ca0686a474ee1662cf6ad94708e987bb1400758/
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2024-02-02 12:24:48 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dorw263t3oq6vi5xazavzidinjdu5ylgft3k3fdqr2mhxmkaa5ma._file
Verdict:
malicious
Result
Malware family:
risepro
Create hunting rule
Score:
  10/10
Tags:
family:risepro evasion stealer
Link:
https://tria.ge/reports/240202-rq9thsadcr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks BIOS information in registry
Identifies Wine through registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
RisePro
Malware Config
C2 Extraction:
193.233.132.62:50500
Unpacked files
SH256 hash:
58fa5ab6c27ff6555f7c62215f92e0e764936e2709a8ad10d3afb714d4b55c5f
MD5 hash:
daffa24fe3362ad70e715bed4a181f83
SHA1 hash:
ce62f55a17c43a9edfb1c470103ec53d59d3e5a7
Link:
https://www.unpac.me/results/77644eae-26c6-4b15-8e57-d069e5df277b/
SH256 hash:
1ba36d7b73dba1eaa3b706415ca0686a474ee1662cf6ad94708e987bb1400758
MD5 hash:
eeec76a506c7bfaae3fe91bfae3e7bc8
SHA1 hash:
5ecdf5385b6eb7cb43fdda492f8443b868f84e8e
Link:
https://www.unpac.me/results/77644eae-26c6-4b15-8e57-d069e5df277b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1ba36d7b73db/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1ba36d7b73dba1eaa3b706415ca0686a474ee1662cf6ad94708e987bb1400758

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RiseProStealer

Executable exe 1ba36d7b73dba1eaa3b706415ca0686a474ee1662cf6ad94708e987bb1400758

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/474201/
  
URLhaus
https://urlhaus.abuse.ch/url/2755484/
  
Delivery method
Distributed via web download

Comments