Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.27824.18326.exe
  • Size 2.2MB
  • SHA256 e6152cc4702000546accc8d72aed7cb2a17381fbfed6b2dae32a336e15440549
  • MD5 1129a9368fb37bebc17280be6a0585a2
  • SHA1 32745b44b02d59149c2dbf0a71ea20d443bca7c0
  • SHA512 7bfa721677e3fd238aa4e94be7db2535caa087567133f30184f739d495b77e5afa71ae1b412d51b9c530642b097d48d60ab968354e567730bbb39c29e25bc1bf
  • SSDEEP 49152:CIu+1zq/WAw1GnD1OfE7X9pEDxDy9LMU9YDrg/:CIP1elwIDwpO3o2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2