Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.17920.19764.exe
  • Size 2.2MB
  • SHA256 9ed76d0cdb1f2b686adb7739764e2bdde84c7497b753cdd92ebefd5efea9b378
  • MD5 3363022cdf5204b21a816d8f6f5cc4f1
  • SHA1 e2afec164f68999d032ac1e96684ee31d52a518e
  • SHA512 56d5e97f383c4122718e7eafe7bb0e7851a6a16c7a7a00251847e7792a2c38c56cf58d76182d03673e070b9fbfb2ce456fde740ea4c209d2418e3e624e80d287
  • SSDEEP 49152:RIbZioGRjQfAm2RyeU1FtTXLF82TIOWGRsPS0kcxhvPsbNHN3Hp8r:KFyjQo1Rmr9btWGR0/EHq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2