MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88a40354963fb6aa908467e10aac5330ac9c0a336231049fabaa9025e4b6c8b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	88a40354963fb6aa908467e10aac5330ac9c0a336231049fabaa9025e4b6c8b3
SHA3-384 hash:	fe7db2829d4a3b8b756388089e6f8fdf296676efd3a8406fb95b483ecbcc3e7e06dee9ae5989433b3037f7db1e9167bd
SHA1 hash:	e7ac92ff6111a4d3fd18d868414626386a9ab40f
MD5 hash:	2bdee88e07974c5fdef32556dfe96404
humanhash:	solar-grey-september-nitrogen
File name:	SecuriteInfo.com.Trojan.Siggen22.34353.23197.31636
Download:	download sample
Signature	RiseProStealer Alert Create hunting rule
File size:	1'683'045 bytes
First seen:	2023-12-16 08:22:37 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a391c991ba6330d6ddb5beaa15ef064c (303 x RiseProStealer, 7 x RisePro)
ssdeep	49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u
Threatray	2'309 similar samples on MalwareBazaar
TLSH	T1F7756C31A741B462F86314B5725E57E611A235302B92C8D7F7C16FAEB2A2BD39334E13
TrID	68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 12.5% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	SecuriteInfoCom
Tags:	exe RiseProStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

283

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/467963/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Siggen22.34353.23197.31636.UNOFFICIAL

Alert

Create hunting rule

Win.Malware.Midie-10016707-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Dragonfly

Gathering data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

control crypto fingerprint greyware lolbin overlay setupapi shell32

Link:

https://www.filescan.io/uploads/657d5e716b1c246046f665a9/reports/f0b946d7-d575-4c99-8592-5211d77388d9/overview

Hybrid Analysis Zusy.Generic

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/88a40354963fb6aa908467e10aac5330ac9c0a336231049fabaa9025e4b6c8b3

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer RisePro Stealer

Malware family:

RisePro Stealer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/042f17c6-15ec-48d5-a0ce-9b2ba5d99a60

Joe Sandbox PrivateLoader

Result

Threat name:

PrivateLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1363306

Signature

Contains functionality to inject threads in other processes

Found stalling execution ending in API Sleep call

Multi AV Scanner detection for submitted file

Yara detected PrivateLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/88a40354963fb6aa908467e10aac5330ac9c0a336231049fabaa9025e4b6c8b3

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/88a40354963fb6aa908467e10aac5330ac9c0a336231049fabaa9025e4b6c8b3/

ReversingLabs TitaniumCloud Win32.Trojan.RisePro

Threat name:

Win32.Trojan.RisePro

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-16 08:23:11 UTC

File Type:

PE (Exe)

Extracted files:

1

AV detection:

21 of 23 (91.30%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rcsagvewh63kveeem7qqvlctgcwjycrtmiyqjh5lvkiclzfwzczq._file

Threatray malicious

Verdict:

malicious

Similar samples:

67f6aa5c680b96907b75de39219afb903d747e4bb04ccb0667294f4f33722fc4

RiseProStealer

831a7fc8af679573ef26e6b8b2296fd0f77a43946a1dbabf357ca1d5556177ff

RiseProStealer

8750bdd67a1ecaa07e2431fc016af78133ccf06a33b1118af63bfdddc5ec5670

RiseProStealer

cdd43a1c420208cb24f8d8f45647107984ad55474db55fe0eee4a70c1deee718

RiseProStealer

f3d20110ebce5e630f9f601b808a0d978965faf1288f7821abe6593315ddff14

RiseProStealer

ffc3ebf8ebd71f03906d8f56d9342486ad3a65612aa58c02662bf6d3187b1b29

RiseProStealer

+ 2'299 additional samples on MalwareBazaar

Hatching Triage risepro

Result

Malware family:

risepro

Alert

Create hunting rule

Score:

  10/10

Tags:

family:privateloader family:risepro

Link:

https://tria.ge/reports/231216-j96bfacde5/

Malware Config

C2 Extraction:

193.233.132.51

UnpacMe

Unpacked files

SH256 hash:

88a40354963fb6aa908467e10aac5330ac9c0a336231049fabaa9025e4b6c8b3

MD5 hash:

2bdee88e07974c5fdef32556dfe96404

SHA1 hash:

e7ac92ff6111a4d3fd18d868414626386a9ab40f

Link:

https://www.unpac.me/results/8f53e6b6-e2fb-49cf-b7a8-1e1cf2c08dc7/

VMRay PrivateLoader

Malware family:

PrivateLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/88a40354963f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/88a40354963fb6aa908467e10aac5330ac9c0a336231049fabaa9025e4b6c8b3

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/467963/