General
-
Target
f799b4eab761e7e7eaadd9cac0e654a1604964fab4d2e48fcb26cc7dcf20ce50.exe
-
Size
2.2MB
-
Sample
250318-l6g6jszvdy
-
MD5
bb9a68e4b3ec377a6e91c2c9a8074931
-
SHA1
d9f29becfe59be891ab0955bdef4079d3264fc4b
-
SHA256
f799b4eab761e7e7eaadd9cac0e654a1604964fab4d2e48fcb26cc7dcf20ce50
-
SHA512
784c36c60d6f54abaaf3f71252d551e04b0fe3211d74cca17da6bbd2e77b6b85f951603054a1f91cd1c11a7ee741df885ed763c66e5c50b75b8d9f1f4cef60d3
-
SSDEEP
49152:AB0vmtT5qmRdVuL9rNM9xz4mA6JMk1Y0/GiIIb:A2WYmRdVuLRNIfMk14Ib
Static task
static1
Behavioral task
behavioral1
Sample
f799b4eab761e7e7eaadd9cac0e654a1604964fab4d2e48fcb26cc7dcf20ce50.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f799b4eab761e7e7eaadd9cac0e654a1604964fab4d2e48fcb26cc7dcf20ce50.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
risepro
193.233.132.74:58709
Targets
-
-
Target
f799b4eab761e7e7eaadd9cac0e654a1604964fab4d2e48fcb26cc7dcf20ce50.exe
-
Size
2.2MB
-
MD5
bb9a68e4b3ec377a6e91c2c9a8074931
-
SHA1
d9f29becfe59be891ab0955bdef4079d3264fc4b
-
SHA256
f799b4eab761e7e7eaadd9cac0e654a1604964fab4d2e48fcb26cc7dcf20ce50
-
SHA512
784c36c60d6f54abaaf3f71252d551e04b0fe3211d74cca17da6bbd2e77b6b85f951603054a1f91cd1c11a7ee741df885ed763c66e5c50b75b8d9f1f4cef60d3
-
SSDEEP
49152:AB0vmtT5qmRdVuL9rNM9xz4mA6JMk1Y0/GiIIb:A2WYmRdVuLRNIfMk14Ib
Score10/10-
Risepro family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-