General
-
Target
57d99fe054cbb267b5792badd77badbd04643528eb70446a60775eff737d4a50
-
Size
2.2MB
-
Sample
240415-tal4maac28
-
MD5
9f57df06ceadcf44454dcc3b5bec9c5b
-
SHA1
a6d710d3bcdd65ad977a37c704985a19b0da2849
-
SHA256
57d99fe054cbb267b5792badd77badbd04643528eb70446a60775eff737d4a50
-
SHA512
87b63ec0e9c5088369586be6cd87a9d640282dee75fd21efadc38cdee0d4e860d787d2612b48eee3d5be6842b02eb697500a4c9bb1113edd95d1d8f8141bf86d
-
SSDEEP
49152:ZSUl6vD5DxN6HHLJ9tza6WWtSh7wyvq6ebjTFDX7/ZEeCJLOeqX9:ZSSwD5Dxkum4Ly6S5X7REe6L4X
Static task
static1
Behavioral task
behavioral1
Sample
57d99fe054cbb267b5792badd77badbd04643528eb70446a60775eff737d4a50.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
risepro
147.45.47.93:58709
Targets
-
-
Target
57d99fe054cbb267b5792badd77badbd04643528eb70446a60775eff737d4a50
-
Size
2.2MB
-
MD5
9f57df06ceadcf44454dcc3b5bec9c5b
-
SHA1
a6d710d3bcdd65ad977a37c704985a19b0da2849
-
SHA256
57d99fe054cbb267b5792badd77badbd04643528eb70446a60775eff737d4a50
-
SHA512
87b63ec0e9c5088369586be6cd87a9d640282dee75fd21efadc38cdee0d4e860d787d2612b48eee3d5be6842b02eb697500a4c9bb1113edd95d1d8f8141bf86d
-
SSDEEP
49152:ZSUl6vD5DxN6HHLJ9tza6WWtSh7wyvq6ebjTFDX7/ZEeCJLOeqX9:ZSSwD5Dxkum4Ly6S5X7REe6L4X
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-