MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3ede159946ba4cef06f2ae6ebcd7268f44b63409e7f8bf113078ba7b79fef3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RiseProStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 6 File information Comments

SHA256 hash:	d3ede159946ba4cef06f2ae6ebcd7268f44b63409e7f8bf113078ba7b79fef3f
SHA3-384 hash:	dd48d725ec928079d6248449f0acdfd2701135b217ce69535a42539e7e3f74448558db3310182b7e6e0e7458f0c792c8
SHA1 hash:	0d5dc3fbcb2c65e82db8e75182b8f9f96ed4e412
MD5 hash:	642b57b84e44b48223b80fdd2aa982ad
humanhash:	beer-kansas-april-saturn
File name:	file
Download:	download sample
Signature	RiseProStealer Create hunting rule
File size:	3'394'104 bytes
First seen:	2023-11-17 12:04:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4e4a6bcb0a4d906241efada3b9ef82b0 (6 x RiseProStealer, 2 x RedLineStealer)
ssdeep	49152:IM7wMc13tn/rx+h6a3vHaMl1nD36dczWC/7di1:rux+o7o1GdcKi7d6
Threatray	82 similar samples on MalwareBazaar
TLSH	T17BF5D51166F90749F5F31EBA26BAB6114C7ABC29AB11C3CF155057CE0B26AD0A870F37
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	andretavare5
Tags:	exe RiseProStealer

andretavare5

Sample downloaded from http://194.49.94.154/trend/home.exe

Intelligence

File Origin

# of uploads :

# of downloads :

394

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/458941/

Detection(s):

Win.Malware.Botx-10004968-0

Win.Trojan.Fugrafa-10010052-0

Win.Packed.Pwsx-10012424-0

Win.Trojan.Stealerc-10014035-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Forced shutdown of a system process

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

89%

Tags:

control lolbin overlay packed

Link:

https://www.filescan.io/uploads/655756ef0290ea202bc7921e/reports/ff76073f-9cfe-4da0-ade6-56e205262125/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/d3ede159946ba4cef06f2ae6ebcd7268f44b63409e7f8bf113078ba7b79fef3f

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e98a696c-a6b9-4970-812d-e10b308f5a41

Result

Threat name:

PrivateLoader, RisePro Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1344095

Signature

Allocates memory in foreign processes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found stalling execution ending in API Sleep call

Injects a PE file into a foreign processes

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected PrivateLoader

Yara detected RisePro Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d3ede159946ba4cef06f2ae6ebcd7268f44b63409e7f8bf113078ba7b79fef3f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d3ede159946ba4cef06f2ae6ebcd7268f44b63409e7f8bf113078ba7b79fef3f/

Threat name:

Win32.Trojan.RecordBreaker

Status:

Malicious

First seen:

2023-11-17 12:05:07 UTC

File Type:

PE (Exe)

AV detection:

18 of 23 (78.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2pw6cwmunosm54dpfltoxtlsnd2ewy2atz7yx4ita6f2pn47547q._file

Verdict:

malicious

RiseProStealer

741a509a0a46937736f7496cddf49f85d7400139bb673c49387800bd1b8d1fef

RiseProStealer

9efa69e298aba38cdc05ea191b2e3f8cdc305cb9414e426196cf85082c1015d4

RiseProStealer

aeebd9d6617f6203323d39761ce1cd949cdb7b05ed4c8a1ddb5693c48606c9e2

RiseProStealer

d3ede159946ba4cef06f2ae6ebcd7268f44b63409e7f8bf113078ba7b79fef3f

RiseProStealer

d714f4e239526bf43ea4122e515899a1bc017474fbc5becf14b4f8f3cd6fa75e

RiseProStealer

dda58e02acca78a978c8ae8a82b34e3dee6db965b3c101731cbec2850cf5477f

RiseProStealer

+ 72 additional samples on MalwareBazaar

Result

Malware family:

risepro

Score:

10/10

Tags:

family:privateloader family:risepro loader stealer

Link:

https://tria.ge/reports/231117-n86m2ahb82/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

PrivateLoader

RisePro

Malware Config

C2 Extraction:

194.49.94.152

Unpacked files

SH256 hash:

26ecdfca2b57d7f9e1576dc255cd03e31bdcc02137eb6613b9c62013f7ec80ff

MD5 hash:

b3e8dfdd96ae821b0375deaa671d5ce5

SHA1 hash:

acff9f768c61ad43fa35c957e63a92ac50af2aaf

Detections:

SUSP_XORed_URL_In_EXE

Link:

https://www.unpac.me/results/fa091aa3-97d7-43f0-8730-ed8d687a7e7e/

Parent samples :

d3ede159946ba4cef06f2ae6ebcd7268f44b63409e7f8bf113078ba7b79fef3f
0a453bb9fad90369d0de1b1c13a3f8b56241d90c81a3f1408d99072dd6d64ce1
ea9091b9b280a8cfb2f1f49a6b80d8086c67d8681d6db7629dce7106bf1e354e
4c30cc4804651690a1fc9e71f00005bb0732671bc41c2674cda388bba172ea85
bcf0a5b47c85feb87d61913b364009ea43da0f7036d5bbf5d0f4c89493ff4f59
7dd544e44b731a9fb4ee33390c223fda80608d3ac515299133d389a18818004f

SH256 hash:

d3ede159946ba4cef06f2ae6ebcd7268f44b63409e7f8bf113078ba7b79fef3f

MD5 hash:

642b57b84e44b48223b80fdd2aa982ad

SHA1 hash:

0d5dc3fbcb2c65e82db8e75182b8f9f96ed4e412

Link:

https://www.unpac.me/results/fa091aa3-97d7-43f0-8730-ed8d687a7e7e/

Malware family:

PrivateLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d3ede159946b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d3ede159946ba4cef06f2ae6ebcd7268f44b63409e7f8bf113078ba7b79fef3f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Dropped by

PrivateLoader

Delivery method

Distributed via drive-by

Cape

https://www.capesandbox.com/analysis/458941/

URLhaus

https://urlhaus.abuse.ch/url/2731456/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample