MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38b996babe91a3ea4fac1e349e0723d40621107dfd34f14bd2d4764fbb695b31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RiseProStealer


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38b996babe91a3ea4fac1e349e0723d40621107dfd34f14bd2d4764fbb695b31
SHA3-384 hash: cbfa8fe346a2313b2c19fb4b9277d02f33d7459505e2a6ac0bde06d67a0f3a64010e9e60be2be89e50de3926bf8e60f1
SHA1 hash: 644c0119a86163376e6eaac88356f971e87040c9
MD5 hash: 8b8b26e8bfb7b546d6298536f47b4020
humanhash: snake-oregon-echo-may
File name:8b8b26e8bfb7b546d6298536f47b4020.exe
Download: download sample
Signature RiseProStealer
Create hunting rule
File size:462'848 bytes
First seen:2023-12-16 01:55:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 6144:KBy+bnr+gp0yN90QEYWcmZVyKalT4/wye6Kzmba5hYpKy1+EylETFM42BdSKKE9:LMrIy90nwPMw5msL/42B0K1
TLSH T199A4021762E89073DCB21BB05CF707D70B367C81A978835B2B95994E0CB39A4A93537B
TrID 41.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
22.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
11.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
7.5% (.EXE) Win64 Executable (generic) (10523/12/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:exe RiseProStealer


Avatar
abuse_ch
RiseProStealer C2:
91.92.249.253:50500

Intelligence

File Origin
# of uploads :
1
# of downloads :
356
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/467845/
Detection(s):
Sanesecurity.Malware.28840.BadO.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file
Running batch commands
Launching a process
Searching for the window
Sending a custom TCP request
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Reading critical registry keys
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
advpack anti-vm CAB confuserex control explorer installer lolbin lolbin packed packed replace rundll32 setupapi sfx shell32 zusy
Link:
https://www.filescan.io/uploads/657d03b27d4bdb7f8bf4eeb2/reports/02b8be25-45c0-4d48-848f-21a8d6ed8ce3/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/38b996babe91a3ea4fac1e349e0723d40621107dfd34f14bd2d4764fbb695b31
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/a4781f5d-c5a2-4101-a589-2b981a0d4fe4
Result
Threat name:
LummaC Stealer, RedLine, RisePro Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1363164
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Connects to many ports of the same IP (likely port scanning)
Creates a thread in another existing process (thread injection)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected LummaC Stealer
Yara detected RedLine Stealer
Yara detected RisePro Stealer
Yara detected SmokeLoader
Yara detected Stealc
Yara detected Vidar stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1363164 Sample: 12hMgY5GVz.exe Startdate: 16/12/2023 Architecture: WINDOWS Score: 100 137 soupinterestoe.fun 2->137 139 reviveincapablewew.pw 2->139 141 13 other IPs or domains 2->141 163 Snort IDS alert for network traffic 2->163 165 Multi AV Scanner detection for domain / URL 2->165 167 Found malware configuration 2->167 169 18 other signatures 2->169 10 12hMgY5GVz.exe 1 4 2->10         started        13 OfficeTrackerNMP131.exe 14 59 2->13         started        16 MaxLoonaFest131.exe 2->16         started        18 3 other processes 2->18 signatures3 process4 file5 121 C:\Users\user\AppData\Local\...\5fT3Ut8.exe, PE32 10->121 dropped 123 C:\Users\user\AppData\Local\...\2ft6863.exe, PE32 10->123 dropped 20 5fT3Ut8.exe 10->20         started        23 2ft6863.exe 16 68 10->23         started        125 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 13->125 dropped 127 C:\...\ebbkgkIKocfkSwX0yQIAx9w002gtYtg2.zip, Zip 13->127 dropped 225 Multi AV Scanner detection for dropped file 13->225 227 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->227 229 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 13->229 27 WerFault.exe 13->27         started        129 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 16->129 dropped 131 C:\...\WhRDETGUpAWGyJx9mHtSb1V80TzcSqpP.zip, Zip 16->131 dropped 231 Tries to steal Mail credentials (via file / registry access) 16->231 233 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 16->233 235 Queries memory information (via WMI often done to detect virtual machines) 16->235 29 WerFault.exe 16->29         started        133 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 18->133 dropped 135 C:\...\Dm6QjRGde5b2AObfbqz0YUd6cis7yj9p.zip, Zip 18->135 dropped 31 WerFault.exe 18->31         started        33 WerFault.exe 18->33         started        35 WerFault.exe 18->35         started        37 6 other processes 18->37 signatures6 process7 dnsIp8 193 Multi AV Scanner detection for dropped file 20->193 195 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 20->195 197 Maps a DLL or memory area into another process 20->197 205 2 other signatures 20->205 39 explorer.exe 20->39 injected 149 91.92.249.253, 49729, 49730, 49731 THEZONEBG Bulgaria 23->149 151 ipinfo.io 34.117.186.192, 443, 49732, 49733 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 23->151 105 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 23->105 dropped 107 C:\Users\user\AppData\...\FANBooster131.exe, PE32 23->107 dropped 109 C:\Users\user\AppData\...\MaxLoonaFest131.exe, PE32 23->109 dropped 111 2 other malicious files 23->111 dropped 199 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 23->199 201 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 23->201 203 Found many strings related to Crypto-Wallets (likely being stolen) 23->203 207 2 other signatures 23->207 44 cmd.exe 1 23->44         started        46 cmd.exe 1 23->46         started        48 WerFault.exe 23->48         started        file9 signatures10 process11 dnsIp12 153 185.215.113.68, 49754, 80 WHOLESALECONNECTIONSNL Portugal 39->153 155 5.42.65.125, 49765, 80 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 39->155 157 2 other IPs or domains 39->157 113 C:\Users\user\AppData\Local\Temp\F68C.exe, PE32 39->113 dropped 115 C:\Users\user\AppData\Local\Temp\F3AC.exe, PE32 39->115 dropped 117 C:\Users\user\AppData\Local\TempD33.exe, PE32 39->117 dropped 119 4 other malicious files 39->119 dropped 219 System process connects to network (likely due to code injection or exploit) 39->219 221 Benign windows process drops PE files 39->221 50 F3AC.exe 39->50         started        54 FANBooster131.exe 39->54         started        56 CC4.exe 39->56         started        66 5 other processes 39->66 223 Uses schtasks.exe or at.exe to add and modify task schedules 44->223 58 conhost.exe 44->58         started        60 schtasks.exe 1 44->60         started        62 conhost.exe 46->62         started        64 schtasks.exe 1 46->64         started        file13 signatures14 process15 dnsIp16 87 C:\Users\user\AppData\Roaming\...\File2.exe, PE32 50->87 dropped 89 C:\Users\user\AppData\Roaming\...\File1.exe, PE32 50->89 dropped 171 Multi AV Scanner detection for dropped file 50->171 69 File2.exe 50->69         started        72 File1.exe 50->72         started        75 conhost.exe 50->75         started        91 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 54->91 dropped 93 C:\...\3uIYjkR7TIBgSyKkU61y90lXVhGHyM4A.zip, Zip 54->93 dropped 173 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 54->173 175 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 54->175 177 Tries to steal Mail credentials (via file / registry access) 54->177 191 3 other signatures 54->191 77 WerFault.exe 54->77         started        95 C:\Users\user\AppData\...\Protect544cd51a.dll, PE32 56->95 dropped 179 Found many strings related to Crypto-Wallets (likely being stolen) 56->179 181 Sample uses process hollowing technique 56->181 79 RegSvcs.exe 56->79         started        81 WerFault.exe 56->81         started        143 diagramfiremonkeyowwa.fun 104.21.18.224, 49759, 80 CLOUDFLARENETUS United States 66->143 145 soupinterestoe.fun 104.21.24.252, 49755, 80 CLOUDFLARENETUS United States 66->145 147 5 other IPs or domains 66->147 97 C:\Users\user\AppData\Local\Temp\tuc3.exe, PE32 66->97 dropped 99 C:\Users\user\AppData\Local\...\toolspub2.exe, PE32 66->99 dropped 101 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 66->101 dropped 103 3 other malicious files 66->103 dropped 183 Detected unpacking (changes PE section rights) 66->183 185 Detected unpacking (overwrites its own PE header) 66->185 187 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 66->187 189 Tries to steal Crypto Currency Wallets 66->189 83 WerFault.exe 66->83         started        85 WerFault.exe 66->85         started        file17 signatures18 process19 dnsIp20 209 Multi AV Scanner detection for dropped file 69->209 211 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 69->211 213 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 69->213 215 Tries to steal Crypto Currency Wallets 69->215 159 176.123.10.211, 47430, 49766 ALEXHOSTMD Moldova Republic of 72->159 161 195.20.16.103 EITADAT-ASFI Finland 79->161 217 Tries to harvest and steal browser information (history, passwords, etc) 79->217 signatures21
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/38b996babe91a3ea4fac1e349e0723d40621107dfd34f14bd2d4764fbb695b31
Detection:
smokeloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/38b996babe91a3ea4fac1e349e0723d40621107dfd34f14bd2d4764fbb695b31/
Threat name:
ByteCode-MSIL.Trojan.RiseProStealer
Create hunting rule
Status:
Malicious
First seen:
2023-12-16 01:56:05 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
17 of 37 (45.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hc4znov6sgr6ut5mdy2j4bzd2qdcced57u2pcs6s2r3e7o3jlmyq._file
Verdict:
malicious
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:lumma family:redline family:smokeloader botnet:@oleh_ps backdoor collection discovery infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/231216-ccn8bsbdf7/
Behaviour
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Checks SCSI registry key(s)
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Enumerates physical storage devices
Program crash
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Detect Lumma Stealer payload V4
Lumma Stealer
RedLine
RedLine payload
SmokeLoader
Malware Config
C2 Extraction:
http://185.215.113.68/fks/index.php
176.123.7.190:32927
Unpacked files
SH256 hash:
2587366e63ac771973313d8123781139f3ebe4dd39f64748d1dbabdba4dddb9f
MD5 hash:
a2dfa914a641f04ce50b029de167c153
SHA1 hash:
b62030944239d5955b7249c9dc77fd45f2b46bc6
Detections:
INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Link:
https://www.unpac.me/results/adad1dd3-309f-4bc4-9047-6c6051eaedae/
Parent samples :
678850b820d703f0827a3e25e75003e742318f6b4722190686f541e23fc61a70
38b996babe91a3ea4fac1e349e0723d40621107dfd34f14bd2d4764fbb695b31
525ef68461df129f55d9afcca76d8bd3ad66c84c1b1ba7b12596094709845285
1d6c14b25f0c8e28799b4b6de6bf9d6282e6f3b4bb65afad9ad2bb5b40331d21
ada55b3992eec712e70558797f967f29de65052612874b3455b9230d847ed219
SH256 hash:
eae829fa646f084afe6691ebcefa1e02722a2cd358f85d7190d93d25475e6a36
MD5 hash:
0d65161f24b94c692c1dcfd789b20405
SHA1 hash:
2039c83c852861e0d8c310a028fa79a3218cf054
Detections:
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/adad1dd3-309f-4bc4-9047-6c6051eaedae/
Parent samples :
9b115d4d9d27cca513836b8222f9cddd3697ca71ec2456645bab03a788cf30e2
678850b820d703f0827a3e25e75003e742318f6b4722190686f541e23fc61a70
38b996babe91a3ea4fac1e349e0723d40621107dfd34f14bd2d4764fbb695b31
ada55b3992eec712e70558797f967f29de65052612874b3455b9230d847ed219
SH256 hash:
38b996babe91a3ea4fac1e349e0723d40621107dfd34f14bd2d4764fbb695b31
MD5 hash:
8b8b26e8bfb7b546d6298536f47b4020
SHA1 hash:
644c0119a86163376e6eaac88356f971e87040c9
Detections:
win_redline_wextract_hunting_oct_2023
Create hunting rule
Link:
https://www.unpac.me/results/adad1dd3-309f-4bc4-9047-6c6051eaedae/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RiseProStealer

Executable exe 38b996babe91a3ea4fac1e349e0723d40621107dfd34f14bd2d4764fbb695b31

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2738241/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/467845/

Comments