Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.27020.26387.exe
  • Size 2.2MB
  • SHA256 3a649fa91a13523a86b7bd178fb4ccf28970d1627bfb4ece042a42f020262697
  • MD5 d6a339754292a9feebfd3660fbac3a55
  • SHA1 5021f26c951626d2e3e4473c221886b0eb9b5fdd
  • SHA512 46be2cd40a0594cf87a9991982cf00c89c173bd6a58089de343a3c123720c8faaa54d933321e00a3d2f83f764b3071f7543112a02bc8a9abdc1f32012b17984d
  • SSDEEP 49152:vOEiPsx7rouKqmsX0Zf89lOOmCvS0+NgIynZ7KDNMrDuExSzWf6:vOEUsxNKqmsX+k7P+NzyKDirDh0Wf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2