Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.4658.24953.exe
  • Size 2.2MB
  • SHA256 e67d59bdccd0a723648e585caf8628475526afe73549f67b8cb7f5ba40acbf4c
  • MD5 441351a5c2463e06dec891450412c0d0
  • SHA1 0552c9dc41ee732224229c1835a763d0a0486ce7
  • SHA512 b7830ca255861010833fc8a0cd310629b5d2db986838f83c9d5ce940cc41522878cfde1667f531be2f2d547910e292f894610b29ad0f8158d1e0d5a20af8a92f
  • SSDEEP 49152:zqnCjWcUJmOvPdMbYnNyOwyimflZbDLUyy+RaQscI:zoNDHdtNm+fDXgyXaxc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2