General
-
Target
d21dbfef87407263a0f22c099a1d8b59a14267b9523463ee91b261fc3e046acc
-
Size
2.2MB
-
Sample
240603-kbt17aac95
-
MD5
1de07a0c44239e14342f6bf02e5bd091
-
SHA1
193160495ec9e9dbeded1b7c34bc8ccf517d6d26
-
SHA256
d21dbfef87407263a0f22c099a1d8b59a14267b9523463ee91b261fc3e046acc
-
SHA512
ec21a0ee388dd4959839f0a69e15dd7a3ed6d42b0d33718e2767e7dfe9f4ac651508da508a266d7bd6cb7fbffb9cc7b65a1e9c1c2bea11ca8335963df6144e33
-
SSDEEP
49152:okmKhyq24kI3qebVaebcpqYwvxeKvHN31vxfOmzuRf8R55OdTF:okmKEqlkAbkOp5vtlgsU+55O
Static task
static1
Behavioral task
behavioral1
Sample
d21dbfef87407263a0f22c099a1d8b59a14267b9523463ee91b261fc3e046acc.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
risepro
147.45.47.126:58709
Targets
-
-
Target
d21dbfef87407263a0f22c099a1d8b59a14267b9523463ee91b261fc3e046acc
-
Size
2.2MB
-
MD5
1de07a0c44239e14342f6bf02e5bd091
-
SHA1
193160495ec9e9dbeded1b7c34bc8ccf517d6d26
-
SHA256
d21dbfef87407263a0f22c099a1d8b59a14267b9523463ee91b261fc3e046acc
-
SHA512
ec21a0ee388dd4959839f0a69e15dd7a3ed6d42b0d33718e2767e7dfe9f4ac651508da508a266d7bd6cb7fbffb9cc7b65a1e9c1c2bea11ca8335963df6144e33
-
SSDEEP
49152:okmKhyq24kI3qebVaebcpqYwvxeKvHN31vxfOmzuRf8R55OdTF:okmKEqlkAbkOp5vtlgsU+55O
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-