Hunt queries (Shodan, Censys, Fofa, URLScan)
-
Hunt query sharings are temporarily disabled.
Summary
TL; DR: An emerging Windows info-stealer
Type: Information stealer
Targeted Operating Systems: Windows
Threat tag: win.risepro
Reporting: https://malpedia.caad.fkie.fraunhofer.de/details/win.risepro
Screenshots
IOCs
- 194.169.175.249:8081
- 194.87.71.215:8081
- 194.169.175.133:8081
- 194.169.175.144:8081
- 37.27.22.139:8081
- 45.153.242.202:8081
- 193.233.132.55:8081
- 193.233.132.88:8081
- 193.233.132.61:8081
- 194.36.177.30:8081
- 5.101.0.60:8081
- 95.217.5.29:8081
- 5.188.159.44:8081
- 195.20.16.224:8081
- 209.145.58.236:8081
- 193.233.132.67:8081
- 195.20.16.210:8081
- 195.20.16.207:8081
- 193.233.132.62:8081
- 92.246.138.90:8081
- 193.233.132.74:8081
- 87.121.87.59:8081
- 5.101.1.60:8081
- 193.233.132.49:8081
- 193.163.170.166:8081
- 45.134.26.17:8081
- 193.233.132.64:8081
- 193.233.132.135:8081
- 193.163.7.139:8081
- 193.233.132.116:8081
- 193.233.132.37:8081
- 94.156.69.28:8081
- 147.45.45.67:8081
- 37.120.237.196:8081
- 193.233.132.195:8081
- 193.233.132.214:8081
- 167.235.136.41:8081
- 193.233.132.193:8081
- 193.233.132.216:8081
- 74.248.32.95:8081
- 144.76.184.11:8081
- 193.233.132.223:8081
- 193.233.132.190:8081
- 193.233.132.234:8081
- 193.233.132.18:8081
- 193.233.132.81:8081
- 91.92.242.86:8081
- 193.233.132.235:8081
- 20.215.188.233:8081
- 89.23.102.221:8081
- 94.156.69.246:8081
- 193.233.132.89:8081
- 91.92.244.67:8081
- 193.181.23.156:8081
- 193.233.132.10:8081
- 193.233.132.48:8081
- 194.33.191.159:8081
- 107.155.112.166:8081
- 193.233.132.32:8081
- 213.183.63.187:8081
- 193.233.132.67:666
- 193.233.132.194:8081
- 193.233.132.113:8081
- 185.221.198.67:8081
- 185.237.206.57:8081
- 89.23.99.198:8081
- 65.21.21.176:8081
- 89.23.99.219:8081
- 193.233.132.127:8081
- 95.216.41.236:8081
- 193.233.132.148:8081
- 147.45.47.80:8081
- 147.45.47.116:8081
- 5.42.92.73:8081
- 193.233.132.159:8081
- 45.156.21.39:8081
- 193.233.132.162:8081
- 193.233.132.180:8081
- 193.233.132.147:8081
- 193.233.132.224:8081
- 185.196.9.38:8081
- 101.99.92.169:8081
- 5.42.65.117:8081
- 193.233.132.114:8081
- 77.221.156.212:8081
- 193.233.132.11:8081
- 92.42.96.24:8081
- 64.94.85.165:8081
- 107.167.93.99:8081
- 93.183.95.223:8081
- 81.19.137.205:8081
- 185.141.61.74:8081
- 217.195.207.156:8081
- 77.221.151.10:8081
- 2.58.56.221:8081
- 77.221.151.12:8081
- 94.156.64.237:8081
- 147.45.47.93:8081
- 147.45.47.101:8081
- 147.45.47.102:8081
- 193.233.132.217:8081
- 193.233.132.47:8081
- 193.233.132.72:8081
- 185.172.128.65:8081
- 78.142.18.109:8081
- 193.142.146.101:8081
- 91.92.245.49:8081
- 107.178.105.96:8081
- 147.45.47.147:8081
- 5.42.96.65:8081
- 5.42.96.55:8081
- 5.42.96.54:8081
- 5.42.96.14:8081
- 77.221.151.92:8081
- 5.42.96.91:8081
- 94.156.68.83:8081
- 217.12.208.114:8088
- 5.42.96.191:8081
- 172.105.121.169:8081
- 5.42.96.77:8081
- 54.180.28.87:8081
- 77.238.229.68:8081
- 5.42.96.100:8081
- 91.92.255.209:8081
- 209.222.101.102:8081
- 77.221.151.106:8081
- 147.45.47.149:8081
- 5.42.96.64:8081
- 18.209.224.126:8081
- 5.61.33.19:8081
- 95.164.87.54:8081
- 118.194.235.187:8081
- 5.42.65.116:8081
- 185.172.128.136:8081
- 5.180.154.49:8081
- 5.42.67.8:8081
- 3.36.173.8:8081
- 77.91.77.122:8081
- 77.91.77.66:8081
- 193.233.254.16:8081
- 77.91.77.117:8081
- 77.91.77.51:8081
- 77.91.77.65:8081
- 77.91.77.95:8081
- 185.216.70.126:8081
- 77.91.77.67:8081
- 147.45.44.49:8081
- 147.45.44.48:8081
- 147.45.47.134:8081
- 147.45.47.176:8081
- 77.91.77.180:8081
- 77.105.132.27:8081
- 103.253.17.111:8081
- 89.117.52.151:8081
- 193.233.132.59:80
- 193.233.132.11:80
- 101.99.92.169:80
- 5.42.92.73:80
- 5.42.65.117:80
- 193.233.132.5:80
- 193.233.132.109:80
- 193.233.132.169:8081
- 193.233.132.109:8081
- 193.233.132.108:8081
- 45.15.156.142:8081
- 193.233.132.106:8081
- 193.233.132.253:8081
- 193.233.132.226:8081
- 45.138.16.166:8081
- 193.233.132.58:8081
- 193.233.132.101:8081
- 45.15.156.9:8081
- 193.233.132.22:8081
- 77.221.151.20:8081
- 147.45.47.126:8081
- 94.156.65.126:8081