General
-
Target
4787cdb99014b54c7ca19e78a19756c678d16b5e0de32877aa2247451215eec0.exe
-
Size
2.2MB
-
Sample
240415-bg5kfaae22
-
MD5
3574861601824abc4d12218c22af1b41
-
SHA1
969e45b34a72451a97139f29a0fb53e2a2e875e3
-
SHA256
4787cdb99014b54c7ca19e78a19756c678d16b5e0de32877aa2247451215eec0
-
SHA512
927fc8b60e3ecc8482a9f19f485ebd195eb289513851353ba64dc50b4cec995628a4826bddd9546e5e7f1d642464f5f494a017bc828378200e586c7bc87ed7e3
-
SSDEEP
49152:dSUl6vD5DxN6HHLJFwfcx8U84xRbpxy9QbOYXAwtga5UAb970iREX6IBG:dSSwD5DxkyM8x4xhp9A1a5Pbx0iRPwG
Static task
static1
Behavioral task
behavioral1
Sample
4787cdb99014b54c7ca19e78a19756c678d16b5e0de32877aa2247451215eec0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4787cdb99014b54c7ca19e78a19756c678d16b5e0de32877aa2247451215eec0.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
risepro
147.45.47.93:58709
Targets
-
-
Target
4787cdb99014b54c7ca19e78a19756c678d16b5e0de32877aa2247451215eec0.exe
-
Size
2.2MB
-
MD5
3574861601824abc4d12218c22af1b41
-
SHA1
969e45b34a72451a97139f29a0fb53e2a2e875e3
-
SHA256
4787cdb99014b54c7ca19e78a19756c678d16b5e0de32877aa2247451215eec0
-
SHA512
927fc8b60e3ecc8482a9f19f485ebd195eb289513851353ba64dc50b4cec995628a4826bddd9546e5e7f1d642464f5f494a017bc828378200e586c7bc87ed7e3
-
SSDEEP
49152:dSUl6vD5DxN6HHLJFwfcx8U84xRbpxy9QbOYXAwtga5UAb970iREX6IBG:dSSwD5DxkyM8x4xhp9A1a5Pbx0iRPwG
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-