MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a3490f08a118f2e2c927e3458c6d0251773127c7a03060067f79298f4a28906. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RiseProStealer


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a3490f08a118f2e2c927e3458c6d0251773127c7a03060067f79298f4a28906
SHA3-384 hash: 1e3d9b7b0803fcf966117dd829d0f76a2bd5dd5fde6b38704c8e8f3d66dc371b655142a034aa3c9704e2edb474e2e8ba
SHA1 hash: 947fea3321f460a6ae04a88c002e166e070bf0ab
MD5 hash: 90a5eb29532a722693b5e42b92e4e913
humanhash: glucose-november-lake-fifteen
File name:SecuriteInfo.com.Win32.TrojanX-gen.31721.25602
Download: download sample
Signature RiseProStealer
Create hunting rule
File size:2'290'688 bytes
First seen:2024-02-02 16:24:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash baa93d47220682c04d92f7797d9224ce (139 x RiseProStealer, 26 x Xtrat, 18 x CoinMiner)
ssdeep 49152:eXF6KJqJaBV4MDPQaXHxp+OcphfwX+EoSE9Krk4OiZ4MPoaLJ2TA:eXF6QqJaDXPQ2Hf+l/fVEfqKr3OilHJa
TLSH T135B533FEEE755243DA032B3982AC469500836C5BDA81DC3ACD74F6178BFC936E149D25
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4505/5/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon cc31e8cccce833cc (116 x RiseProStealer, 1 x Amadey)
Reporter SecuriteInfoCom
Tags:exe RiseProStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
290
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/474216/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.31721.25602.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed packed themidawinlicense
Link:
https://www.filescan.io/uploads/65bd1760b012cce0edb99007/reports/9ec65a3a-715b-4c05-9371-1e39f0714a9e/overview
Verdict:
Malicious
Labled as:
Strictor.Generic
Link:
https://www.hybrid-analysis.com/sample/3a3490f08a118f2e2c927e3458c6d0251773127c7a03060067f79298f4a28906
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/cfab896f-d8e3-411d-a9cd-6cfc2a0a4c4f
Result
Threat name:
Amadey, RedLine, RisePro Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1385714
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
Connects to many ports of the same IP (likely port scanning)
Creates multiple autostart registry keys
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Potentially malicious time measurement code found
Snort IDS alert for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Amadeys stealer DLL
Yara detected RedLine Stealer
Yara detected RisePro Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1385714 Sample: SecuriteInfo.com.Win32.Troj... Startdate: 02/02/2024 Architecture: WINDOWS Score: 100 79 youtube-ui.l.google.com 2->79 81 www.youtube.com 2->81 83 23 other IPs or domains 2->83 113 Snort IDS alert for network traffic 2->113 115 Antivirus detection for URL or domain 2->115 117 Antivirus / Scanner detection for submitted sample 2->117 119 9 other signatures 2->119 9 SecuriteInfo.com.Win32.TrojanX-gen.31721.25602.exe 2 115 2->9         started        14 MPGPH131.exe 2 2->14         started        16 RageMP131.exe 2 2->16         started        18 8 other processes 2->18 signatures3 process4 dnsIp5 95 185.215.113.68 WHOLESALECONNECTIONSNL Portugal 9->95 97 109.107.182.3, 49711, 80 TELEPORT-TV-ASRU Russian Federation 9->97 103 2 other IPs or domains 9->103 71 C:\Users\user\...\v0MhC1vJCq2GP44Pzfz2.exe, PE32 9->71 dropped 73 C:\Users\user\...\ca83gako585GV5iFmndh.exe, PE32 9->73 dropped 75 C:\Users\user\...\Zf2H8u6LGfmnHmobAlrr.exe, PE32 9->75 dropped 77 13 other malicious files 9->77 dropped 139 Detected unpacking (changes PE section rights) 9->139 141 Binary is likely a compiled AutoIt script file 9->141 143 Tries to steal Mail credentials (via file / registry access) 9->143 161 5 other signatures 9->161 20 3ONz8ZKy7E1bdXskySA6.exe 9->20         started        23 v0MhC1vJCq2GP44Pzfz2.exe 9->23         started        25 PETaq6vZZ_6JLzPpioZc.exe 13 9->25         started        34 6 other processes 9->34 145 Antivirus detection for dropped file 14->145 147 Multi AV Scanner detection for dropped file 14->147 149 Machine Learning detection for dropped file 14->149 151 Tries to evade debugger and weak emulator (self modifying code) 16->151 153 Hides threads from debuggers 16->153 155 Tries to detect sandboxes / dynamic malware analysis system (registry check) 16->155 99 142.250.105.190 GOOGLEUS United States 18->99 101 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 GOOGLEUS United States 18->101 105 6 other IPs or domains 18->105 157 Found many strings related to Crypto-Wallets (likely being stolen) 18->157 159 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->159 27 msedge.exe 18->27         started        30 firefox.exe 18->30         started        32 firefox.exe 18->32         started        37 3 other processes 18->37 file6 signatures7 process8 dnsIp9 121 Detected unpacking (changes PE section rights) 20->121 123 Detected unpacking (overwrites its own PE header) 20->123 125 Modifies windows update settings 20->125 135 3 other signatures 20->135 127 Tries to detect sandboxes and other dynamic analysis tools (window names) 23->127 129 Tries to evade debugger and weak emulator (self modifying code) 23->129 131 Hides threads from debuggers 23->131 137 2 other signatures 23->137 133 Binary is likely a compiled AutoIt script file 25->133 39 chrome.exe 25->39         started        42 chrome.exe 25->42         started        44 chrome.exe 25->44         started        54 9 other processes 25->54 107 13.107.213.41 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 27->107 109 23.96.180.189 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 27->109 111 18 other IPs or domains 27->111 69 C:\Users\user\AppData\Local\...\explorhe.exe, PE32 34->69 dropped 46 conhost.exe 34->46         started        48 conhost.exe 34->48         started        50 conhost.exe 34->50         started        52 conhost.exe 34->52         started        file10 signatures11 process12 dnsIp13 85 192.168.2.5, 443, 49705, 49707 unknown unknown 39->85 87 239.255.255.250 unknown Reserved 39->87 56 chrome.exe 39->56         started        59 chrome.exe 42->59         started        61 chrome.exe 44->61         started        63 msedge.exe 54->63         started        65 msedge.exe 54->65         started        67 msedge.exe 54->67         started        process14 dnsIp15 89 clients.l.google.com 108.177.122.101, 443, 49718 GOOGLEUS United States 56->89 91 www3.l.google.com 142.250.105.139 GOOGLEUS United States 56->91 93 13 other IPs or domains 56->93
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3a3490f08a118f2e2c927e3458c6d0251773127c7a03060067f79298f4a28906
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a3490f08a118f2e2c927e3458c6d0251773127c7a03060067f79298f4a28906/
Threat name:
Win32.Spyware.Risepro
Create hunting rule
Status:
Malicious
First seen:
2024-02-02 13:40:14 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
21 of 24 (87.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hi2jb4ekcghs4lespy2frrwqeulxget4pibqmadh66jjr5fcreda._file
Verdict:
malicious
Result
Malware family:
risepro
Create hunting rule
Score:
  10/10
Tags:
family:risepro evasion stealer
Link:
https://tria.ge/reports/240202-twx31scefl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks BIOS information in registry
Identifies Wine through registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
RisePro
Malware Config
C2 Extraction:
193.233.132.62:50500
Unpacked files
SH256 hash:
99c9543ef7a2cb383412df5b51e09d2a494258683a422c6bdcb52126582da97c
MD5 hash:
e16c093d8c86abac5f33863c3cd31893
SHA1 hash:
1faa89da42c859342a9df4f235b46c0dd7852764
Link:
https://www.unpac.me/results/ff6b4565-cc89-45db-bbf7-44001df8e0dd/
SH256 hash:
3a3490f08a118f2e2c927e3458c6d0251773127c7a03060067f79298f4a28906
MD5 hash:
90a5eb29532a722693b5e42b92e4e913
SHA1 hash:
947fea3321f460a6ae04a88c002e166e070bf0ab
Link:
https://www.unpac.me/results/ff6b4565-cc89-45db-bbf7-44001df8e0dd/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3a3490f08a11/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3a3490f08a118f2e2c927e3458c6d0251773127c7a03060067f79298f4a28906

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/474216/

Comments