General
-
Target
cf28b21dc4b9dcb4a5e268157a09acf3eadef55e287775de8825c7b4364f2efb
-
Size
2.3MB
-
Sample
240526-fgd5psgc65
-
MD5
9ed5a8d67bfd60e8c1209693b14c353e
-
SHA1
e0cc6e78cce015f26517ca868871e5dd6e30ac1f
-
SHA256
cf28b21dc4b9dcb4a5e268157a09acf3eadef55e287775de8825c7b4364f2efb
-
SHA512
ada9332f83213f97c6d49d3a0c888846985b863eb21bbefe557dc4f6e3664248838d22df2712b8c94f49b57e57408cb20080d3b1ea5e4543de2ecf63e94d015d
-
SSDEEP
49152:XkmKhyq24kI3qebVaSHlI71yw7iBgNtajLcvm9PySiYETL:XkmKEqlkAbkPZjOBgNt+LZ9yL
Static task
static1
Behavioral task
behavioral1
Sample
cf28b21dc4b9dcb4a5e268157a09acf3eadef55e287775de8825c7b4364f2efb.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
risepro
147.45.47.126:58709
Targets
-
-
Target
cf28b21dc4b9dcb4a5e268157a09acf3eadef55e287775de8825c7b4364f2efb
-
Size
2.3MB
-
MD5
9ed5a8d67bfd60e8c1209693b14c353e
-
SHA1
e0cc6e78cce015f26517ca868871e5dd6e30ac1f
-
SHA256
cf28b21dc4b9dcb4a5e268157a09acf3eadef55e287775de8825c7b4364f2efb
-
SHA512
ada9332f83213f97c6d49d3a0c888846985b863eb21bbefe557dc4f6e3664248838d22df2712b8c94f49b57e57408cb20080d3b1ea5e4543de2ecf63e94d015d
-
SSDEEP
49152:XkmKhyq24kI3qebVaSHlI71yw7iBgNtajLcvm9PySiYETL:XkmKEqlkAbkPZjOBgNt+LZ9yL
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-