General
-
Target
228e31b70e6e44c7732afe3d70b38522d9be07212bfe207c725d3dbf5c07a194
-
Size
2.3MB
-
Sample
240527-jv5fladb5z
-
MD5
6b835d32da0ebe53fd1ba63ac95019cf
-
SHA1
98756360606b86e2b00174d2f5ecd42b873b80a3
-
SHA256
228e31b70e6e44c7732afe3d70b38522d9be07212bfe207c725d3dbf5c07a194
-
SHA512
876a935ed564f0849a22b06d4df688f943cd6f3dcf8c09e9e5f9420376b930f8c59e03825e8d34288bb0f4cf193306855cdbefb3eed4095e96bd417708d21144
-
SSDEEP
49152:nkmKhyq24kI3qebVaUJ3T3HxVZkvQbTnSOIdOuwaAywuNH:nkmKEqlkAbkqV8QbznIKaIuF
Static task
static1
Behavioral task
behavioral1
Sample
228e31b70e6e44c7732afe3d70b38522d9be07212bfe207c725d3dbf5c07a194.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
risepro
147.45.47.126:58709
Targets
-
-
Target
228e31b70e6e44c7732afe3d70b38522d9be07212bfe207c725d3dbf5c07a194
-
Size
2.3MB
-
MD5
6b835d32da0ebe53fd1ba63ac95019cf
-
SHA1
98756360606b86e2b00174d2f5ecd42b873b80a3
-
SHA256
228e31b70e6e44c7732afe3d70b38522d9be07212bfe207c725d3dbf5c07a194
-
SHA512
876a935ed564f0849a22b06d4df688f943cd6f3dcf8c09e9e5f9420376b930f8c59e03825e8d34288bb0f4cf193306855cdbefb3eed4095e96bd417708d21144
-
SSDEEP
49152:nkmKhyq24kI3qebVaUJ3T3HxVZkvQbTnSOIdOuwaAywuNH:nkmKEqlkAbkqV8QbznIKaIuF
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-