Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.16804.2700.exe
  • Size 2.2MB
  • SHA256 ff929610da21ce2107e91d87767e50dbbfd938d39e7e6ff0d4cc892e2cb78c2a
  • MD5 2baf02a8c34c8fe2e508cf7ae33f2c50
  • SHA1 c379e166cc14fa1a8cc5435fc0bc4df5038c72a3
  • SHA512 8e084181011a3112981cf1861a20654dcd020eb982b183bea197c94e480c2a5b561e3095b22ac51f2b807717a909a304f53522ef3b1373e6de300dfea2c06f1c
  • SSDEEP 49152:HzsBT9bevpXU7Bkjn69mVO4IIbZPSrOVMDjzg5AKJw7JLrQ0KylM:TsBT9mZwkj6kVB9btEOVCjSAKJw7nM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2