Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.22310.9631.exe
  • Size 2.2MB
  • SHA256 823eae4953acf964bc3fb9e14c2caaea8be3f3bbc962c13289b2539d2e319748
  • MD5 0825fb3dd6d428235a177bd0ad681d65
  • SHA1 2ad91354330bfb619ddd344f5dad561b72e2dacd
  • SHA512 bd37932d384f987dd8b5633e5747f326eb294bb11042acebb1d2de31153e57e92338992e5a100edabacd6fe6bd55eec84d5a7c6cf8eac96a7106958ca488c80a
  • SSDEEP 49152:i5DC/i9QXvLNx9jRz8sdBlb7oz/f8fzKuMD4dQOHSA3Oh:1iafLNPRYsdBdG/fQWD4dQi53Oh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2