MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4841f0dbc222ec7aca0ef48abbadf84ad429d2ec8aeaa87eadf35ac2cd55ba7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RisePro


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4841f0dbc222ec7aca0ef48abbadf84ad429d2ec8aeaa87eadf35ac2cd55ba7
SHA3-384 hash: fa72836dbbcc891d3d43953122cd0274ff4b80fcf29bbd4de476d5326c940a713dcee2a49da5535acf6f084dc6107753
SHA1 hash: 5c3e694b04b8c98f3c42992b6ddfede89ffc8cc9
MD5 hash: 4eb552b7b23b64fefd2bc32a45d2f437
humanhash: charlie-triple-blossom-oven
File name:4eb552b7b23b64fefd2bc32a45d2f437.exe
Download: download sample
Signature RisePro
Create hunting rule
File size:6'430'720 bytes
First seen:2023-12-22 07:46:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 98304:3yZGs+vtk+BxTCDf3o/dRi1AwHjrc4vAYogeVvVJe0FbvpZ6xMuhzv:CZm1k+rUf+CAwHXolgetvhFbv9i
Threatray 2'109 similar samples on MalwareBazaar
TLSH T127563306FEE81467CCFD23349CF712520E356A1246A8817EDA4CA2691E72FF865317E7
TrID 41.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
22.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
11.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
7.5% (.EXE) Win64 Executable (generic) (10523/12/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:exe RisePro

Intelligence

File Origin
# of uploads :
1
# of downloads :
268
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
RisePro
Create hunting rule
Link:
https://www.capesandbox.com/analysis/468964/
Detection(s):
Sanesecurity.Malware.28840.BadO.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
advpack anti-vm CAB control explorer installer lolbin net packed risepro rundll32 setupapi sfx shell32
Link:
https://www.filescan.io/uploads/65853efab4e856b72823416a/reports/a91fa86f-147b-4775-9c91-36686d133934/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/c4841f0dbc222ec7aca0ef48abbadf84ad429d2ec8aeaa87eadf35ac2cd55ba7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/737bd74f-596a-4fcb-8249-d2c6a726718d
Result
Threat name:
RisePro Stealer, SmokeLoader, Vidar, zgR
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1366060
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Connects to many IPs within the same subnet mask (likely port scanning)
Contains functionality to modify clipboard data
Detected unpacking (changes PE section rights)
Found API chain indicative of sandbox detection
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has a writeable .text section
Phishing site detected (based on logo match)
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected RisePro Stealer
Yara detected SmokeLoader
Yara detected Vidar stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1366060 Sample: qVn2uj3FTs.exe Startdate: 22/12/2023 Architecture: WINDOWS Score: 100 117 stun.l.google.com 2->117 119 play.google.com 2->119 121 ipinfo.io 2->121 133 Snort IDS alert for network traffic 2->133 135 Found malware configuration 2->135 137 Malicious sample detected (through community Yara rule) 2->137 139 17 other signatures 2->139 11 qVn2uj3FTs.exe 1 4 2->11         started        14 FANBooster131.exe 2->14         started        17 OfficeTrackerNMP131.exe 2->17         started        20 6 other processes 2->20 signatures3 process4 dnsIp5 97 C:\Users\user\AppData\Local\...\nY6wP88.exe, PE32 11->97 dropped 99 C:\Users\user\AppData\Local\...\7HU9xt49.exe, PE32 11->99 dropped 22 nY6wP88.exe 1 4 11->22         started        101 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 14->101 dropped 103 C:\...\ktZgEbHuMoxzgN8FaeQijOCT36Fz6gwC.zip, Zip 14->103 dropped 169 Multi AV Scanner detection for dropped file 14->169 171 Detected unpacking (changes PE section rights) 14->171 173 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 14->173 187 5 other signatures 14->187 26 WerFault.exe 14->26         started        113 91.92.249.253 THEZONEBG Bulgaria 17->113 115 ipinfo.io 34.117.186.192 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 17->115 105 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 17->105 dropped 107 C:\...\2G2wZ7syFEBdlB5zX3RcPl5FGnTuY5Ar.zip, Zip 17->107 dropped 175 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 17->175 177 Query firmware table information (likely to detect VMs) 17->177 179 Tries to steal Mail credentials (via file / registry access) 17->179 28 WerFault.exe 17->28         started        30 WerFault.exe 17->30         started        109 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 20->109 dropped 111 C:\...\ifl39sqUJvugrNyRSFs5GG6d8Ndn1Pex.zip, Zip 20->111 dropped 181 Machine Learning detection for dropped file 20->181 183 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 20->183 185 Queries memory information (via WMI often done to detect virtual machines) 20->185 32 WerFault.exe 20->32         started        file6 signatures7 process8 file9 85 C:\Users\user\AppData\Local\...\od4PY27.exe, PE32 22->85 dropped 87 C:\Users\user\AppData\Local\...\6nq3fr1.exe, PE32 22->87 dropped 145 Antivirus detection for dropped file 22->145 147 Multi AV Scanner detection for dropped file 22->147 149 Machine Learning detection for dropped file 22->149 34 od4PY27.exe 1 4 22->34         started        signatures10 process11 file12 81 C:\Users\user\AppData\Local\...\4tF388nQ.exe, PE32 34->81 dropped 83 C:\Users\user\AppData\Local\...\1gf52rz9.exe, PE32 34->83 dropped 141 Multi AV Scanner detection for dropped file 34->141 143 Machine Learning detection for dropped file 34->143 38 4tF388nQ.exe 15 69 34->38         started        42 1gf52rz9.exe 12 34->42         started        signatures13 process14 file15 89 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 38->89 dropped 91 C:\Users\user\AppData\...\FANBooster131.exe, PE32 38->91 dropped 93 C:\Users\user\AppData\...\MaxLoonaFest131.exe, PE32 38->93 dropped 95 2 other malicious files 38->95 dropped 151 Multi AV Scanner detection for dropped file 38->151 153 Detected unpacking (changes PE section rights) 38->153 155 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 38->155 165 8 other signatures 38->165 44 cmd.exe 38->44         started        47 cmd.exe 38->47         started        49 WerFault.exe 38->49         started        51 WerFault.exe 38->51         started        157 Binary is likely a compiled AutoIt script file 42->157 159 Machine Learning detection for dropped file 42->159 161 Found API chain indicative of sandbox detection 42->161 163 Contains functionality to modify clipboard data 42->163 53 chrome.exe 9 42->53         started        56 chrome.exe 42->56         started        58 chrome.exe 42->58         started        60 6 other processes 42->60 signatures16 process17 dnsIp18 167 Uses schtasks.exe or at.exe to add and modify task schedules 44->167 73 2 other processes 44->73 75 2 other processes 47->75 123 192.168.2.5 unknown unknown 53->123 125 239.255.255.250 unknown Reserved 53->125 62 chrome.exe 53->62         started        77 2 other processes 53->77 65 chrome.exe 56->65         started        67 chrome.exe 58->67         started        69 chrome.exe 60->69         started        71 chrome.exe 60->71         started        79 4 other processes 60->79 signatures19 process20 dnsIp21 127 tpop-api.twitter.com 104.244.42.130 TWITTERUS United States 62->127 129 twitter.com 104.244.42.193 TWITTERUS United States 62->129 131 113 other IPs or domains 62->131
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c4841f0dbc222ec7aca0ef48abbadf84ad429d2ec8aeaa87eadf35ac2cd55ba7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c4841f0dbc222ec7aca0ef48abbadf84ad429d2ec8aeaa87eadf35ac2cd55ba7/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-12-21 14:50:09 UTC
File Type:
PE (Exe)
Extracted files:
176
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yscb6dn4eixmplfa55ekxow7qswufhjozcxkvb7k3422ylgvlotq._file
Verdict:
malicious
Similar samples:
380edb414750f511e72ad11116e24b9dc1888350ac13ca6d0cf0bbdc1baec4df
RisePro
50ca2730d4feb93b8d6cf986a86b34912d83c10dd7d7259d3538d415c904af73
RisePro
850263d1dac582f1d8c9cb585e73b54124ed5c9c58564a89508072b93d73865b
RisePro
862ff11452de99418139941018e044e7802fad311d21ddd396a5476adbe56352
RisePro
8a7cc5239d412feb2e6977e47b1f3ca475fb70172ac200b81ed7700a4097564f
RisePro
+ 2'099 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion persistence themida trojan
Link:
https://tria.ge/reports/231222-jmh8dsedh4/
Behaviour
Creates scheduled task(s)
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
AutoIT Executable
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Checks whether UAC is enabled
Checks BIOS information in registry
Executes dropped EXE
Loads dropped DLL
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c
MD5 hash:
c5124caf4aea3a83b63a9108fe0dcef8
SHA1 hash:
a43a5a59038fca5a63fa526277f241f855177ce6
Link:
https://www.unpac.me/results/142ab201-e98a-4633-9647-9281ba96ae60/
SH256 hash:
efd75c1e81fc3edf969a7c42fc26edc308eaef27c08d1f45ef77125682cc5bdc
MD5 hash:
681c020479961ada483bd07151618d10
SHA1 hash:
9b3c3ab10a406bcb86536b99db8f3ef82705e03a
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/142ab201-e98a-4633-9647-9281ba96ae60/
SH256 hash:
c4841f0dbc222ec7aca0ef48abbadf84ad429d2ec8aeaa87eadf35ac2cd55ba7
MD5 hash:
4eb552b7b23b64fefd2bc32a45d2f437
SHA1 hash:
5c3e694b04b8c98f3c42992b6ddfede89ffc8cc9
Detections:
win_redline_wextract_hunting_oct_2023
Create hunting rule
Link:
https://www.unpac.me/results/142ab201-e98a-4633-9647-9281ba96ae60/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c4841f0dbc22/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c4841f0dbc222ec7aca0ef48abbadf84ad429d2ec8aeaa87eadf35ac2cd55ba7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RisePro

Executable exe c4841f0dbc222ec7aca0ef48abbadf84ad429d2ec8aeaa87eadf35ac2cd55ba7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2738241/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/468964/

Comments