MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c14181430cc691bfe7a5e62f6fd617a0aeaf175e7f4c10ca29f55320ce05f02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RiseProStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 1 File information Comments

SHA256 hash:	4c14181430cc691bfe7a5e62f6fd617a0aeaf175e7f4c10ca29f55320ce05f02
SHA3-384 hash:	1ea097f67648a3238c2cc0d128d1da26f1e1e83e289259f2ef21abc7aa7da772823d33d1dd11b547b376e6409845d29c
SHA1 hash:	760ef7804d3023ec8cee66cfb658f68db78c7d2c
MD5 hash:	560764dc55f487c742cab502974a3734
humanhash:	ten-oscar-robert-venus
File name:	560764dc55f487c742cab502974a3734.exe
Download:	download sample
Signature	RiseProStealer Create hunting rule
File size:	8'120'832 bytes
First seen:	2024-03-20 16:40:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	03bcb6eefa774e3f071dbe7eb2020ec7 (2 x RiseProStealer)
ssdeep	196608:FeXJlf8rF5I/SXgoejCjBY1yHVw/IQUM328YjUoNEhMGV7E:FeXgGo9ejCjBY5/IC32JjUM
TLSH	T1328623527C859ED8FC9C50308A29D8BD36B13DB584910AABB1FC7F9EADF2150B937409
TrID	56.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 11.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 9.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.1% (.EXE) Win32 Executable (generic) (4504/4/1) 3.7% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	f0d0d0d0d8c0c4c4 (2 x RiseProStealer)
Reporter	abuse_ch
Tags:	exe RiseProStealer

abuse_ch

RiseProStealer C2:
109.120.184.220:50500

Intelligence

File Origin

# of uploads :

# of downloads :

373

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

4c14181430cc691bfe7a5e62f6fd617a0aeaf175e7f4c10ca29f55320ce05f02.exe

Verdict:

Malicious activity

Analysis date:

2024-03-20 16:41:44 UTC

Tags:

risepro

Link:

https://app.any.run/tasks/9c788c88-d9df-4d7e-9b54-ad36f5c93b07

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sending a custom TCP request

DNS request

Sending an HTTP GET request

Сreating synchronization primitives

Reading critical registry keys

Creating a file in the %temp% subdirectories

Creating a window

Creating a file

Launching a process

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Moving a file to the Program Files subdirectory

Replacing files

Stealing user critical data

Connection attempt to an infection source

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Sending an HTTP GET request to an infection source

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

crypto lolbin packed setupapi shell32

Link:

https://www.filescan.io/uploads/65fb11a1c1137bbf149f811e/reports/60bb51eb-1e9f-4b22-b0fd-e5ca145f060c/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/4c14181430cc691bfe7a5e62f6fd617a0aeaf175e7f4c10ca29f55320ce05f02

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/7d4b35ca-82ff-4c70-b996-cf79f3e9d662

Result

Threat name:

PrivateLoader, RisePro Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1412599

Signature

Antivirus detection for URL or domain

Creates HTML files with .exe extension (expired dropper behavior)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Snort IDS alert for network traffic

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected PrivateLoader

Yara detected RisePro Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/4c14181430cc691bfe7a5e62f6fd617a0aeaf175e7f4c10ca29f55320ce05f02

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4c14181430cc691bfe7a5e62f6fd617a0aeaf175e7f4c10ca29f55320ce05f02/

Threat name:

Win32.Trojan.Privateloader

Status:

Malicious

First seen:

2024-03-20 16:41:07 UTC

File Type:

PE (Exe)

Extracted files:

244

AV detection:

17 of 23 (73.91%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jqkbqfbqzrurx7t2lzrpn7lbpifov4lv472mcdfct5ktedhal4ba._file

Verdict:

malicious

Result

Malware family:

risepro

Score:

10/10

Tags:

family:privateloader family:risepro loader stealer

Link:

https://tria.ge/reports/240320-t6321sdh5z/

Behaviour

Suspicious behavior: EnumeratesProcesses

PrivateLoader

RisePro

Malware Config

C2 Extraction:

109.120.184.220:50500

Unpacked files

SH256 hash:

4c14181430cc691bfe7a5e62f6fd617a0aeaf175e7f4c10ca29f55320ce05f02

MD5 hash:

560764dc55f487c742cab502974a3734

SHA1 hash:

760ef7804d3023ec8cee66cfb658f68db78c7d2c

Link:

https://www.unpac.me/results/f03cec84-b66c-4ad9-a7f7-a888356bcb32/

Malware family:

RisePro

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4c14181430cc/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4c14181430cc691bfe7a5e62f6fd617a0aeaf175e7f4c10ca29f55320ce05f02

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RiseProStealer

exe 4c14181430cc691bfe7a5e62f6fd617a0aeaf175e7f4c10ca29f55320ce05f02

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2786273/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
DP_API	Uses DP API	CRYPT32.dll::CryptUnprotectData
GDI_PLUS_API	Interfaces with Graphics	gdiplus.dll::GdipGetImageEncoders
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteA
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::LoadLibraryA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample