Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.17329.11089.exe
  • Size 2.3MB
  • SHA256 cb9c4d1d3bdec4066ee2ab596cbbe4846a28130e42ffae0b0a336b26e29a8a37
  • MD5 c159e1afe2a3c91d43fe0eff54762e77
  • SHA1 d5281e569927bed7d7a912218abec8635caa646c
  • SHA512 cbd1c6f39f75049d9cbc49e137dbf5a1d4c5567928d892794814c4192ba910df357594149f08f363852fe8a9fb6a79f82cebd111d48beede843c68f6cde17d68
  • SSDEEP 49152:q7shFTnqa7OUWpHg/kiEFRnt74LoKwoM1d9vuzPLPccBvQnnafK:q7G8wOUqH+EFR+8KwVjv6PLUiQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2