General
-
Target
fe21615abff48c1cf381b32b023c120ff92f3126f2b194ccfeaf0a7e5b1cd5b1
-
Size
2.2MB
-
Sample
240415-2bz1waca5t
-
MD5
a7aec3039500bdbe58448c742bfd05fe
-
SHA1
eca4302fbea3216e83b5e9f1a04adfa19ad65785
-
SHA256
fe21615abff48c1cf381b32b023c120ff92f3126f2b194ccfeaf0a7e5b1cd5b1
-
SHA512
46f16d6e6c3c88ec1017969c5dca16ce9f5e80302aae935b54954e67cc3df20fedf74ff2a6011398a1c29c75445cdeb4350f4830ca7b955157654967b3e3a149
-
SSDEEP
49152:aSUl6vD5DxN6HHLJFwSjhMqJM+xSu03QUOOPgDjv3nHSuRw8KkC61:aSSwD5DxkZlMqJM+xSXYOKjvnw3kp
Static task
static1
Behavioral task
behavioral1
Sample
fe21615abff48c1cf381b32b023c120ff92f3126f2b194ccfeaf0a7e5b1cd5b1.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
risepro
147.45.47.93:58709
Targets
-
-
Target
fe21615abff48c1cf381b32b023c120ff92f3126f2b194ccfeaf0a7e5b1cd5b1
-
Size
2.2MB
-
MD5
a7aec3039500bdbe58448c742bfd05fe
-
SHA1
eca4302fbea3216e83b5e9f1a04adfa19ad65785
-
SHA256
fe21615abff48c1cf381b32b023c120ff92f3126f2b194ccfeaf0a7e5b1cd5b1
-
SHA512
46f16d6e6c3c88ec1017969c5dca16ce9f5e80302aae935b54954e67cc3df20fedf74ff2a6011398a1c29c75445cdeb4350f4830ca7b955157654967b3e3a149
-
SSDEEP
49152:aSUl6vD5DxN6HHLJFwSjhMqJM+xSu03QUOOPgDjv3nHSuRw8KkC61:aSSwD5DxkZlMqJM+xSXYOKjvnw3kp
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-