General
-
Target
9d1127e926c71fa87145aacdb4c23c4ac2f56659a8ad625feaaae0ef88f9045e
-
Size
2.4MB
-
Sample
240609-m989waae49
-
MD5
3b3c8fa0f78174fa82e4c791d51c6b40
-
SHA1
665ac3dc775cc9d9ec87c22d90246ccbb988d810
-
SHA256
9d1127e926c71fa87145aacdb4c23c4ac2f56659a8ad625feaaae0ef88f9045e
-
SHA512
9a98bc10941bdf2917cd1aadea22d3ea449069e5fe700a31397fed735166edb6106322004e7240000f346631dd638a97c1184679cd6952046c099a8a969da169
-
SSDEEP
49152:nmxbXRpzGFxfNF5BfwAQRJq+yn4mlbZf/0b5blU6u2lrr:nmxFoFjFnYLnq+AllfuJU6u2l
Static task
static1
Behavioral task
behavioral1
Sample
9d1127e926c71fa87145aacdb4c23c4ac2f56659a8ad625feaaae0ef88f9045e.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
risepro
147.45.47.126:58709
Targets
-
-
Target
9d1127e926c71fa87145aacdb4c23c4ac2f56659a8ad625feaaae0ef88f9045e
-
Size
2.4MB
-
MD5
3b3c8fa0f78174fa82e4c791d51c6b40
-
SHA1
665ac3dc775cc9d9ec87c22d90246ccbb988d810
-
SHA256
9d1127e926c71fa87145aacdb4c23c4ac2f56659a8ad625feaaae0ef88f9045e
-
SHA512
9a98bc10941bdf2917cd1aadea22d3ea449069e5fe700a31397fed735166edb6106322004e7240000f346631dd638a97c1184679cd6952046c099a8a969da169
-
SSDEEP
49152:nmxbXRpzGFxfNF5BfwAQRJq+yn4mlbZf/0b5blU6u2lrr:nmxFoFjFnYLnq+AllfuJU6u2l
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-