Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.16208.29712.exe
  • Size 2.2MB
  • SHA256 1f5bdeca95e56f530d84301ac656c0516996e991a61002b22ed3e56d324659c3
  • MD5 fbff3c4e12ffd51bbeebb7445547b4ee
  • SHA1 de7505bf94834c046a66653b03edadba300dcc3d
  • SHA512 3cf25118354ff3d0b1a80c8eaf5fc776d1f4670f7aaa4d731b7af29af287f5f64947a4de1f39972d3c4ed61d64bb9d7fa996f758667670f2b9f45636cd8e4d9d
  • SSDEEP 49152:LlKZBfS7ubypM2NFlLz5RXijo9Iox3Ezg1KSEKQFfoB5wVA3b:xKZVLaNTLz/SXxZKafogK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2