Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.20259.600.exe
  • Size 3.1MB
  • SHA256 b39b838fc01f8b7921b9043cda00ad029a34abbf8abab3060420eb352e20ff2a
  • MD5 0f0db38dbd9a2327b20856e521c41268
  • SHA1 ede6fe06b8b7a8744401c4b756a4e058299e618f
  • SHA512 e8d5649a8b68eba75b47523f5fa16afa9c5e71cc51fb6a3ccb59521d8803aee9dc93bbe0bb9869a7cbc4269090758910157f83915f1ea1eea2f6e90878c71c36
  • SSDEEP 49152:IXN3u+RkDMYW02FoPza3fvkKN3oMg/hOS160VlU0hAS:QUTVKFoPz0fvku3oMgpOHy5hAS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2