MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 487929a170778f1a0b83405417e3dd51ffc423c86ab21f77669070b6578ddf2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RiseProStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments 1

SHA256 hash:	487929a170778f1a0b83405417e3dd51ffc423c86ab21f77669070b6578ddf2d
SHA3-384 hash:	73c6e804dd2af7eec59dcc3180725e9854f24ebe0a2dc186fd922f8245e1d6dbbb4fa02aa71c1692fdae8fa98c30e2b4
SHA1 hash:	9b79d150d84dd644183077bec4c2445e3061f63d
MD5 hash:	20f676755aaed59eae1193bfe9b3ba0e
humanhash:	comet-two-hydrogen-blue
File name:	20f676755aaed59eae1193bfe9b3ba0e
Download:	download sample
Signature	RiseProStealer Create hunting rule
File size:	8'691'712 bytes
First seen:	2024-05-16 01:04:00 UTC
Last seen:	2024-05-16 01:24:58 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d784b50e0634f83cc71436d4fb111768 (9 x RiseProStealer, 1 x RaccoonStealer)
ssdeep	196608:cS1kfyzeeXVqlLJe03EmuFXxj72b5Hp1vWcDv+e:cwkKzeeXVqf0BFh/2RvHDN
TLSH	T15196332363260289E2F8C93DD91B7DE171F70161C981AC7DB9BAE5C327E5DE0E613642
TrID	56.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 11.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 9.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.1% (.EXE) Win32 Executable (generic) (4504/4/1) 3.7% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	00002020200099e9 (1 x RiseProStealer)
Reporter	zbetcheckin
Tags:	32 exe RiseProStealer

Intelligence

File Origin

# of uploads :

# of downloads :

409

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

487929a170778f1a0b83405417e3dd51ffc423c86ab21f77669070b6578ddf2d.exe

Verdict:

Malicious activity

Analysis date:

2024-05-16 01:05:16 UTC

Tags:

risepro

Link:

https://app.any.run/tasks/db80d449-81db-4db8-a5f3-1ac978364a4c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.Evo-gen.19714.22970.UNOFFICIAL

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Connection attempt to an infection source

Sending a TCP request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

crypto fingerprint lolbin packed setupapi shell32

Link:

https://www.filescan.io/uploads/66455b83d7fb0506c939891d/reports/58eabdc2-66b0-4a43-a178-842339699f6b/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/487929a170778f1a0b83405417e3dd51ffc423c86ab21f77669070b6578ddf2d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/76fedbd5-2452-42e3-a400-9d33a591a08f

Result

Threat name:

RisePro Stealer

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1442358

Signature

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Potential thread-based time evasion detected

Snort IDS alert for network traffic

Tries to detect virtualization through RDTSC time measurements

Yara detected RisePro Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/487929a170778f1a0b83405417e3dd51ffc423c86ab21f77669070b6578ddf2d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/487929a170778f1a0b83405417e3dd51ffc423c86ab21f77669070b6578ddf2d/

Threat name:

Win32.Trojan.Privateloader

Status:

Malicious

First seen:

2024-05-15 16:31:27 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 23 (73.91%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jb4stilqo6hruc4dibkbpy65kh74ii6inkzb653gsbylmv4n34wq._file

Result

Malware family:

risepro

Score:

10/10

Tags:

family:risepro stealer

Link:

https://tria.ge/reports/240516-beydcadb5w/

Behaviour

Suspicious behavior: EnumeratesProcesses

RisePro

Malware Config

C2 Extraction:

5.42.96.54:50500

Unpacked files

SH256 hash:

41a558b61447dd498d839f19787aff17bea639758f6b093083abda2c9ade07fe

MD5 hash:

385995e7adb8e7b6e10ead26fd71f883

SHA1 hash:

9733a7f5ee91c9b82c79843ca6b73daf5abea459

Link:

https://www.unpac.me/results/a221435a-a54c-45c2-b547-f68cfc54c237/

SH256 hash:

487929a170778f1a0b83405417e3dd51ffc423c86ab21f77669070b6578ddf2d

MD5 hash:

20f676755aaed59eae1193bfe9b3ba0e

SHA1 hash:

9b79d150d84dd644183077bec4c2445e3061f63d

Link:

https://www.unpac.me/results/a221435a-a54c-45c2-b547-f68cfc54c237/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/487929a170778f1a0b83405417e3dd51ffc423c86ab21f77669070b6578ddf2d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RiseProStealer

exe 487929a170778f1a0b83405417e3dd51ffc423c86ab21f77669070b6578ddf2d

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2799182/

URLhaus

https://urlhaus.abuse.ch/url/2803455/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
DP_API	Uses DP API	CRYPT32.dll::CryptUnprotectData
GDI_PLUS_API	Interfaces with Graphics	gdiplus.dll::GdipGetImageEncoders
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteA
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::WriteProcessMemory KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::WriteConsoleA KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileA
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegQueryValueExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-05-16 01:04:01 UTC

url : hxxp://5.42.66.10/download/th/Retailer_prog.exe