MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25ef0f7912798ce382c529a802d817926761bb52450b2e7f74db7c7788fe6ca7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RiseProStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 10 File information Comments

SHA256 hash:	25ef0f7912798ce382c529a802d817926761bb52450b2e7f74db7c7788fe6ca7
SHA3-384 hash:	f5ea94016fb799b63208ca1fa78f09ed9c4e6aeba8cf718b3cd6ebfcf73cc871bde8272dbc9c0c8f5311bbd1b334efa7
SHA1 hash:	cb173ff21dead880c8c6ef56800af26a3bf00b18
MD5 hash:	e55ec45fbe06da9762af5c85fd35b7d1
humanhash:	red-network-virginia-bluebird
File name:	e55ec45fbe06da9762af5c85fd35b7d1.bin.exe
Download:	download sample
Signature	RiseProStealer Create hunting rule
File size:	819'200 bytes
First seen:	2023-08-11 11:45:10 UTC
Last seen:	2023-08-11 12:34:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	2c86f6022110f96a017da9bcdba46b29 (1 x Fabookie, 1 x QuasarRAT, 1 x RiseProStealer)
ssdeep	24576:CexHxowbK7+McEOEs2QKSY8c8WCtAczSa:CexKw4YtJ2QDnWqzS
Threatray	1 similar samples on MalwareBazaar
TLSH	T1380502C36E91BC20F5219E739D7DC2E6273DFD614D68769A2268FA2F09B00E1C563706
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	70f0f8ccc4f4ecca (1 x RiseProStealer)
Reporter	abuse_ch
Tags:	exe RiseProStealer

abuse_ch

RiseProStealer C2:
168.100.10.122:50500

Intelligence

File Origin

# of uploads :

# of downloads :

273

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

25ef0f7912798ce382c529a802d817926761bb52450b2e7f74db7c7788fe6ca7

Verdict:

Malicious activity

Analysis date:

2023-08-11 05:03:44 UTC

Tags:

risepro stealer

Link:

https://app.any.run/tasks/b840e631-69d7-4f8f-9c79-2de4a3b8b0c1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/442119/

Detection(s):

SecuriteInfo.com.Win32.BotX-gen.16147.28569.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Sending a custom TCP request

DNS request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware masquerade packed

Link:

https://www.filescan.io/uploads/64d61f7adaa9db5053453886/reports/3b8d14a4-2f28-4e0c-b708-69ef00092916/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/25ef0f7912798ce382c529a802d817926761bb52450b2e7f74db7c7788fe6ca7

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c52198fe-bf66-4773-a254-2367c895380e

Result

Threat name:

PrivateLoader, RisePro Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1289974

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected PrivateLoader

Yara detected RisePro Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/25ef0f7912798ce382c529a802d817926761bb52450b2e7f74db7c7788fe6ca7/

Threat name:

Win32.Trojan.RedLine

Status:

Malicious

First seen:

2023-08-11 11:46:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 38 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=exxq66ispggohawffguafwaxsjtwdo2siufs473u3n6hpch6nstq._file

Verdict:

malicious

RiseProStealer

Result

Malware family:

privateloader

Score:

10/10

Tags:

family:privateloader loader spyware stealer

Link:

https://tria.ge/reports/230811-nxaffsee3v/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Program crash

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

PrivateLoader

Malware Config

C2 Extraction:

1.1.1.1

Unpacked files

SH256 hash:

67c7f971f69cbc839c0418dcac409d46b958fd1678763b530fc895fa43afd215

MD5 hash:

049c839f9ef2323055976858dde53040

SHA1 hash:

adf72a56e93deed1901757a0441d485a14408676

Detections:

RiseProXorStr

win_privateloader_w0

Link:

https://www.unpac.me/results/16b09f08-255f-4b57-afa9-c0e734347ba8/

Parent samples :

19e799b44a59412e8f9d66be8176fe6ee1fcd18ee7a740ce899edac3c2310639
25ef0f7912798ce382c529a802d817926761bb52450b2e7f74db7c7788fe6ca7

SH256 hash:

25ef0f7912798ce382c529a802d817926761bb52450b2e7f74db7c7788fe6ca7

MD5 hash:

e55ec45fbe06da9762af5c85fd35b7d1

SHA1 hash:

cb173ff21dead880c8c6ef56800af26a3bf00b18

Link:

https://www.unpac.me/results/16b09f08-255f-4b57-afa9-c0e734347ba8/

Malware family:

PrivateLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/25ef0f791279/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/25ef0f7912798ce382c529a802d817926761bb52450b2e7f74db7c7788fe6ca7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	privateloader Create hunting rule
Author:	andretavare5
Description:	PrivateLoader pay-per-install malware

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

Rule name:	win_privateloader Create hunting rule
Author:	andretavare5
Reference:	https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service

Rule name:	win_privateloader_w0 Create hunting rule
Author:	andretavare5
Reference:	https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service