Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.8991.31115.exe
  • Size 2.3MB
  • SHA256 58849dd19a6bcf7ff4e721baf13feb83de246f3af8267fdd88c74d869af72ac8
  • MD5 6de63b741fdee4cbc14eca52a57ef35e
  • SHA1 0b15d72391f2a9709282b74d22ebf2843d0dd898
  • SHA512 da90c4312ab5aef53c27c890437d6303453d5644a21ec12195cb5cf3ce1d0c82fb8ed596d9877d42d692ab7505226190b12e91e1c069ac35f5d2b1bbe9eb6aa2
  • SSDEEP 49152:OUnN73V3daezRbrWmuercgZ8vdTdr1nD+KpSUyh4p0OWE:DnjJhrnbogWJd5Ce6eprW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2