General

  • Target

    8eb440730667896acf352b4d637cc3933a14a340b202499997f0597fdbec79f2

  • Size

    2.3MB

  • Sample

    240422-taflvada78

  • MD5

    2bb37b5610f4daaf1e8396f360c90c38

  • SHA1

    befea819785316890aa88571b93ba0c5dc494fec

  • SHA256

    8eb440730667896acf352b4d637cc3933a14a340b202499997f0597fdbec79f2

  • SHA512

    5a8a1ec854c7a7273a280f2c280940ec181a9a57ddcc5134207c78c4a0fb1a1d1b2b82e3d255647399eea043f623f1aad631b89337f24e7d2d3c31aa9ee80b7f

  • SSDEEP

    49152:tg69SebPPiKgYy5bkybTQTYDOZ6Gpq15XvXQh5BHfakO+uI4wO9gidgMwb:tg69SebijbTCY+6Gpq15X4vfakrOvbdu

Score
10/10

Malware Config

Targets

    • Target

      8eb440730667896acf352b4d637cc3933a14a340b202499997f0597fdbec79f2

    • Size

      2.3MB

    • MD5

      2bb37b5610f4daaf1e8396f360c90c38

    • SHA1

      befea819785316890aa88571b93ba0c5dc494fec

    • SHA256

      8eb440730667896acf352b4d637cc3933a14a340b202499997f0597fdbec79f2

    • SHA512

      5a8a1ec854c7a7273a280f2c280940ec181a9a57ddcc5134207c78c4a0fb1a1d1b2b82e3d255647399eea043f623f1aad631b89337f24e7d2d3c31aa9ee80b7f

    • SSDEEP

      49152:tg69SebPPiKgYy5bkybTQTYDOZ6Gpq15XvXQh5BHfakO+uI4wO9gidgMwb:tg69SebijbTCY+6Gpq15X4vfakrOvbdu

    Score
    10/10
    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks