MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ad74b6f17c5a179a4a9cf9df91dd45cd9ec8321c6024639753a3e31108ece17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RiseProStealer


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ad74b6f17c5a179a4a9cf9df91dd45cd9ec8321c6024639753a3e31108ece17
SHA3-384 hash: 2982742840f1ff71652dd1344d567a79f5b54d41c911aa1795afe965f04441a51e09d11521e5bffc534014946b941beb
SHA1 hash: 4cd829ddc6fc5c0599191e38b21c31609da4a2dd
MD5 hash: b46be07a8fd4967547ffeeb11358946c
humanhash: moon-diet-connecticut-april
File name:b46be07a8fd4967547ffeeb11358946c
Download: download sample
Signature RiseProStealer
Create hunting rule
File size:2'105'856 bytes
First seen:2024-02-04 22:24:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash baa93d47220682c04d92f7797d9224ce (139 x RiseProStealer, 26 x Xtrat, 18 x CoinMiner)
ssdeep 49152:fdfKiidbeTYI/hGMpvsBKatVtDRsZfzAduOp6P:GbeTxaDtuZQ6
TLSH T1C7A53376CDD0A093C4E0CBB64FEB350727A568F20560AE6466B268F81DCD8D9F471D8E
TrID 52.9% (.EXE) Win32 Executable (generic) (4504/4/1)
23.5% (.EXE) Generic Win/DOS Executable (2002/3)
23.5% (.EXE) DOS Executable Generic (2000/1)
Reporter zbetcheckin
Tags:32 exe RiseProStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
301
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/474541/
Detection(s):
SecuriteInfo.com.FileRepMalware.15119.24543.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed packed themidawinlicense
Link:
https://www.filescan.io/uploads/65c00ebf19fc38091420c650/reports/80ba0ac4-25bb-4f03-8f41-d8be24d508b1/overview
Verdict:
Malicious
Labled as:
Bulz.Generic
Link:
https://www.hybrid-analysis.com/sample/6ad74b6f17c5a179a4a9cf9df91dd45cd9ec8321c6024639753a3e31108ece17
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bae6d085-38c5-44fb-9695-9460f8a5c0f8
Result
Threat name:
RisePro Stealer, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1386415
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies Windows Defender protection settings
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powershell Defender Disable Scan Feature
Snort IDS alert for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected RisePro Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1386415 Sample: G9I1VG8DOU.exe Startdate: 04/02/2024 Architecture: WINDOWS Score: 100 74 ipinfo.io 2->74 80 Snort IDS alert for network traffic 2->80 82 Multi AV Scanner detection for domain / URL 2->82 84 Antivirus detection for URL or domain 2->84 86 10 other signatures 2->86 8 G9I1VG8DOU.exe 21 73 2->8         started        13 MaxLoonaFest131.exe 2->13         started        15 OfficeTrackerNMP131.exe 2->15         started        17 3 other processes 2->17 signatures3 process4 dnsIp5 76 193.233.132.62, 49704, 49713, 49715 FREE-NET-ASFREEnetEU Russian Federation 8->76 78 ipinfo.io 34.117.186.192, 443, 49712, 49714 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 8->78 56 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 8->56 dropped 58 C:\Users\user\AppData\...\FANBooster131.exe, PE32 8->58 dropped 60 C:\Users\user\AppData\...\MaxLoonaFest131.exe, PE32 8->60 dropped 72 2 other malicious files 8->72 dropped 92 Detected unpacking (changes PE section rights) 8->92 94 Detected unpacking (overwrites its own PE header) 8->94 96 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->96 112 7 other signatures 8->112 19 powershell.exe 23 8->19         started        22 cmd.exe 8->22         started        24 powershell.exe 23 8->24         started        30 13 other processes 8->30 62 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 13->62 dropped 64 C:\...\aYP5ZX0fswJGIPj2ykGZbC6QZyh84RO5.zip, Zip 13->64 dropped 98 Antivirus detection for dropped file 13->98 100 Multi AV Scanner detection for dropped file 13->100 102 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 13->102 114 2 other signatures 13->114 32 2 other processes 13->32 66 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 15->66 dropped 104 Machine Learning detection for dropped file 15->104 106 Modifies Windows Defender protection settings 15->106 108 Tries to evade debugger and weak emulator (self modifying code) 15->108 26 powershell.exe 15->26         started        34 12 other processes 15->34 68 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 17->68 dropped 70 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 17->70 dropped 110 Tries to detect sandboxes and other dynamic analysis tools (window names) 17->110 116 2 other signatures 17->116 28 powershell.exe 17->28         started        36 14 other processes 17->36 file6 signatures7 process8 signatures9 88 Found many strings related to Crypto-Wallets (likely being stolen) 19->88 38 conhost.exe 19->38         started        90 Uses schtasks.exe or at.exe to add and modify task schedules 22->90 40 schtasks.exe 22->40         started        42 conhost.exe 24->42         started        44 conhost.exe 26->44         started        46 conhost.exe 28->46         started        48 conhost.exe 30->48         started        50 10 other processes 30->50 52 11 other processes 34->52 54 11 other processes 36->54 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6ad74b6f17c5a179a4a9cf9df91dd45cd9ec8321c6024639753a3e31108ece17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ad74b6f17c5a179a4a9cf9df91dd45cd9ec8321c6024639753a3e31108ece17/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-02-04 22:25:05 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
20 of 24 (83.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nlluw3yxywqxtjfjz6o7shoultm6zazbyybemolvhi7dceeozylq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  10/10
Tags:
collection discovery evasion persistence spyware stealer trojan
Link:
https://tria.ge/reports/240204-2bxwhsebaj/
Behaviour
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Checks BIOS information in registry
Drops startup file
Identifies Wine through registry keys
Loads dropped DLL
Reads user/profile data of web browsers
Windows security modification
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Modifies Windows Defender Real-time Protection settings
Unpacked files
SH256 hash:
6ad74b6f17c5a179a4a9cf9df91dd45cd9ec8321c6024639753a3e31108ece17
MD5 hash:
b46be07a8fd4967547ffeeb11358946c
SHA1 hash:
4cd829ddc6fc5c0599191e38b21c31609da4a2dd
Link:
https://www.unpac.me/results/e7def56a-9a8d-4064-b42c-1575ccc446ca/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6ad74b6f17c5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6ad74b6f17c5a179a4a9cf9df91dd45cd9ec8321c6024639753a3e31108ece17

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RiseProStealer

Executable exe 6ad74b6f17c5a179a4a9cf9df91dd45cd9ec8321c6024639753a3e31108ece17

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/474541/
  
URLhaus
https://urlhaus.abuse.ch/url/2756765/

Comments


Avatar
zbet commented on 2024-02-04 22:24:51 UTC

url : hxxp://109.107.182.38/retro/dota.exe