Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.20833.6180.exe
  • Size 2.3MB
  • SHA256 93bd47d74f9c0eb067469990aedc74497406f8e6d63fa87e8fe28c23ba350e7c
  • MD5 5c39fc273eeedf3bbc9fae54174c14ad
  • SHA1 6cec59486da27e0e5eb74a84b5f0606d9a07bd2d
  • SHA512 ed1b81c82202a3810079d3b3ddc830eac638e5733f4c60ea3b8ee55ccd0e23113ab0ccc5aab441912d8c774d071655dbf6f00ff634594b0bbde18ae02bc04571
  • SSDEEP 49152:GDdCJswW+BLT48KWDi7k11BsiPR08znRc96vvKhvy60iXD45dhQwt/r2:GDdXIT4867IBZRMA3KSiTMxq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2