MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e63ca1fab4f451d24f0844b9183ae69de3fef8022c36a38f116cdd094ee1a746. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RiseProStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 16 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e63ca1fab4f451d24f0844b9183ae69de3fef8022c36a38f116cdd094ee1a746
SHA3-384 hash: 62b2172d60b1f965537aa1460f8f13ab54ad5757976de9e2265ea696e3e8214eaf4b8b05dda33149cdaa174e6e53e1ee
SHA1 hash: c43f9ea79c8c517af121cf3bcc615d7a0a94674d
MD5 hash: 1cdb357c650618a63597a1fa8c813017
humanhash: fanta-twenty-speaker-uniform
File name:1cdb357c650618a63597a1fa8c813017
Download: download sample
Signature RiseProStealer
Create hunting rule
File size:1'195'520 bytes
First seen:2024-01-28 05:04:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5ab723dc8d5af21b79dc301ed6a56a64 (49 x RiseProStealer, 1 x Amadey)
ssdeep 24576:QhWGGfR5iXplIpjwFyIHP70v+wQYBaWnBCqq1NwZ3v0lNoLLtVj:QsYXpIwFyg1lYBaWntq1NwZcQtVj
TLSH T11C4533F5433B65E8D03469F04401679CADE878E5D16851A96F6FB2A51C38CCE3B8BAC3
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4505/5/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
Reporter zbetcheckin
Tags:32 exe RiseProStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
384
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/473234/
Detection(s):
PUA.Win.Packer.EnigmaProtector-5
Create hunting rule

PUA.Win.Packer.EnigmaProtector-12
Create hunting rule

PUA.Win.Packer.EnigmaProtector-9852682-0
Create hunting rule

Win.Trojan.Scar-6903585-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
Creating a file
Launching a process
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Reading critical registry keys
Creating a process from a recently created file
Creating a window
Searching for synchronization primitives
Launching a service
Creating a process with a hidden window
Searching for the browser window
Launching the default Windows debugger (dwwin.exe)
Running batch commands
Changing a file
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a recently created process
Blocking the Windows Defender launch
Disabling the operating system update service
Enabling autorun by creating a file
Sending an HTTP GET request to an infection source
Sending an HTTP POST request to an infection source
Adding an exclusion to Microsoft Defender
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
crypto enigma lolbin obfuscated packed packed setupapi shell32
Link:
https://www.filescan.io/uploads/65b5e080bc91f83c806c8a79/reports/3c354524-9cba-4a16-9c6b-2f3853e9f6b4/overview
Verdict:
Malicious
Labled as:
Ser.Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/e63ca1fab4f451d24f0844b9183ae69de3fef8022c36a38f116cdd094ee1a746
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/8c2537ee-d99d-41a1-85a1-2b300ef21fbd
Result
Threat name:
Amadey, RisePro Stealer, Stealc
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1382226
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to check for running processes (XOR)
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject threads in other processes
Creates an undocumented autostart registry key
Creates HTML files with .exe extension (expired dropper behavior)
Creates multiple autostart registry keys
Detected unpacking (changes PE section rights)
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Downloads suspicious files via Chrome
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies windows update settings
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Sample uses string decryption to hide its real strings
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Amadeys Clipper DLL
Yara detected Amadeys stealer DLL
Yara detected RisePro Stealer
Yara detected Stealc
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1382226 Sample: objsOzazW2.exe Startdate: 28/01/2024 Architecture: WINDOWS Score: 100 117 youtube-ui.l.google.com 2->117 119 www3.l.google.com 2->119 121 49 other IPs or domains 2->121 151 Snort IDS alert for network traffic 2->151 153 Multi AV Scanner detection for domain / URL 2->153 155 Found malware configuration 2->155 157 15 other signatures 2->157 10 objsOzazW2.exe 2 102 2->10         started        15 MPGPH131.exe 86 2->15         started        17 MPGPH131.exe 89 2->17         started        19 9 other processes 2->19 signatures3 process4 dnsIp5 137 185.215.113.68 WHOLESALECONNECTIONSNL Portugal 10->137 139 109.107.182.3 TELEPORT-TV-ASRU Russian Federation 10->139 143 3 other IPs or domains 10->143 99 C:\Users\user\...\vt638UlvDXdtMr8JKZqS.exe, PE32 10->99 dropped 101 C:\Users\user\...\sHr1gtLe2B4vKQv_eyFt.exe, PE32 10->101 dropped 103 C:\Users\user\...\K1uLz0zGPvtTPtRo5GR3.exe, PE32 10->103 dropped 109 10 other malicious files 10->109 dropped 181 Detected unpacking (changes PE section rights) 10->181 183 Contains functionality to check for running processes (XOR) 10->183 185 Binary is likely a compiled AutoIt script file 10->185 203 4 other signatures 10->203 21 K1uLz0zGPvtTPtRo5GR3.exe 10->21         started        25 vt638UlvDXdtMr8JKZqS.exe 10->25         started        27 sHr1gtLe2B4vKQv_eyFt.exe 10->27         started        36 4 other processes 10->36 105 C:\Users\user\...\b9jDZjgR6DgQ4fVzvASQ.exe, PE32 15->105 dropped 111 7 other malicious files 15->111 dropped 187 Multi AV Scanner detection for dropped file 15->187 189 Creates HTML files with .exe extension (expired dropper behavior) 15->189 191 Tries to steal Mail credentials (via file / registry access) 15->191 193 Machine Learning detection for dropped file 15->193 107 C:\Users\user\...\VrU0yXCoZdh7pnBZxBVe.exe, PE32 17->107 dropped 113 7 other malicious files 17->113 dropped 195 Tries to harvest and steal browser information (history, passwords, etc) 17->195 197 Hides threads from debuggers 17->197 141 127.0.0.1 unknown unknown 19->141 115 4 other malicious files 19->115 dropped 199 Creates multiple autostart registry keys 19->199 201 Maps a DLL or memory area into another process 19->201 29 firefox.exe 19->29         started        32 msedge.exe 19->32         started        34 msedge.exe 19->34         started        38 2 other processes 19->38 file6 signatures7 process8 dnsIp9 83 C:\Users\user\AppData\Local\...\explorhe.exe, PE32 21->83 dropped 159 Detected unpacking (changes PE section rights) 21->159 40 explorhe.exe 21->40         started        161 Modifies windows update settings 25->161 163 Disables Windows Defender Tamper protection 25->163 165 Disable Windows Defender notifications (registry) 25->165 167 Disable Windows Defender real time protection (registry) 25->167 169 Binary is likely a compiled AutoIt script file 27->169 45 chrome.exe 27->45         started        47 chrome.exe 27->47         started        49 chrome.exe 27->49         started        59 9 other processes 27->59 145 mitmdetection.services.mozilla.com 18.160.60.125 MIT-GATEWAYSUS United States 29->145 147 142.250.9.136 GOOGLEUS United States 29->147 149 9 other IPs or domains 29->149 85 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 29->85 dropped 87 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 29->87 dropped 51 firefox.exe 29->51         started        53 firefox.exe 29->53         started        171 Hides threads from debuggers 36->171 55 conhost.exe 36->55         started        57 conhost.exe 36->57         started        file10 signatures11 process12 dnsIp13 129 185.172.128.19 NADYMSS-ASRU Russian Federation 40->129 89 C:\Users\user\AppData\Roaming\...\clip64.dll, PE32 40->89 dropped 91 C:\Users\user\AppData\Local\...\latestroc.exe, PE32 40->91 dropped 93 C:\Users\user\AppData\...\latestroc[1].exe, PE32 40->93 dropped 95 C:\Users\user\AppData\Local\...\clip64[1].dll, PE32 40->95 dropped 173 Detected unpacking (changes PE section rights) 40->173 175 Creates an undocumented autostart registry key 40->175 177 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 40->177 179 Hides threads from debuggers 40->179 61 rundll32.exe 40->61         started        64 schtasks.exe 40->64         started        131 192.168.2.4 unknown unknown 45->131 133 192.168.2.23 unknown unknown 45->133 135 239.255.255.250 unknown Reserved 45->135 97 C:\Windows\...behaviorgraphoogle.Widevine.CDM.dll, PE32+ 45->97 dropped 66 chrome.exe 45->66         started        69 chrome.exe 45->69         started        71 chrome.exe 47->71         started        73 chrome.exe 49->73         started        75 msedge.exe 59->75         started        77 msedge.exe 59->77         started        79 msedge.exe 59->79         started        file14 signatures15 process16 dnsIp17 205 System process connects to network (likely due to code injection or exploit) 61->205 81 conhost.exe 64->81         started        123 googleads.g.doubleclick.net 108.177.122.154 GOOGLEUS United States 66->123 125 youtube-ui.l.google.com 108.177.122.190 GOOGLEUS United States 66->125 127 33 other IPs or domains 66->127 signatures18 process19
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e63ca1fab4f451d24f0844b9183ae69de3fef8022c36a38f116cdd094ee1a746
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e63ca1fab4f451d24f0844b9183ae69de3fef8022c36a38f116cdd094ee1a746/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2024-01-28 05:05:08 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4y6kd6vu6ri5etyiis4rqoxgtxr756acfq3khdyrntoqstxbu5da._file
Verdict:
malicious
Result
Malware family:
risepro
Create hunting rule
Score:
  10/10
Tags:
family:risepro stealer
Link:
https://tria.ge/reports/240128-fqtxhsbhf2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
RisePro
Malware Config
C2 Extraction:
193.233.132.62:50500
Unpacked files
SH256 hash:
e63ca1fab4f451d24f0844b9183ae69de3fef8022c36a38f116cdd094ee1a746
MD5 hash:
1cdb357c650618a63597a1fa8c813017
SHA1 hash:
c43f9ea79c8c517af121cf3bcc615d7a0a94674d
Detections:
SUSP_XORed_URL_In_EXE
Create hunting rule
Link:
https://www.unpac.me/results/d200a258-b830-45a2-aaee-6d10ec660650/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e63ca1fab4f451d24f0844b9183ae69de3fef8022c36a38f116cdd094ee1a746

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:EnigmaProtector1XSukhovVladimirSergeNMarkin
Create hunting rule
Author:malware-lu
Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:SUSP_XORed_URL_In_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Generic_Threat_e5f4703f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RiseProStealer

Executable exe e63ca1fab4f451d24f0844b9183ae69de3fef8022c36a38f116cdd094ee1a746

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/473234/

Comments


Avatar
zbet commented on 2024-01-28 05:04:41 UTC

url : hxxp://185.215.113.68/mine/plata.exe