General
-
Target
d7e0fb468578c311368d03a2444fd7d9a565fdf5a25eee8233e39ebc6813ddbe
-
Size
2.3MB
-
Sample
240526-a63lpshc84
-
MD5
ed03f17e9ef4b902e8e12652a4742bef
-
SHA1
7e9063abe3ca66b28765329fca744ad3de5ab0e0
-
SHA256
d7e0fb468578c311368d03a2444fd7d9a565fdf5a25eee8233e39ebc6813ddbe
-
SHA512
165442f73f77fd40163c5f82173c7e403fcc753de17120547317135202eb1efdd05ab223753cdd1347ae876ac1a0aad3fb9755dc17550adff7a4fec96a0df086
-
SSDEEP
49152:IkmKhyq24kI3qebVs5LtHsuNSmmlp++vWP0BUrNidXiMivrSf:IkmKEqlkAbmjsugm4pjvJBUrNiViWf
Static task
static1
Behavioral task
behavioral1
Sample
d7e0fb468578c311368d03a2444fd7d9a565fdf5a25eee8233e39ebc6813ddbe.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
risepro
147.45.47.126:58709
Targets
-
-
Target
d7e0fb468578c311368d03a2444fd7d9a565fdf5a25eee8233e39ebc6813ddbe
-
Size
2.3MB
-
MD5
ed03f17e9ef4b902e8e12652a4742bef
-
SHA1
7e9063abe3ca66b28765329fca744ad3de5ab0e0
-
SHA256
d7e0fb468578c311368d03a2444fd7d9a565fdf5a25eee8233e39ebc6813ddbe
-
SHA512
165442f73f77fd40163c5f82173c7e403fcc753de17120547317135202eb1efdd05ab223753cdd1347ae876ac1a0aad3fb9755dc17550adff7a4fec96a0df086
-
SSDEEP
49152:IkmKhyq24kI3qebVs5LtHsuNSmmlp++vWP0BUrNidXiMivrSf:IkmKEqlkAbmjsugm4pjvJBUrNiViWf
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-