Extracted

• • Target

    9a4ab4289b3ab5a589fa177673e086ab

  • Size

    2.2MB

  • MD5

    9a4ab4289b3ab5a589fa177673e086ab

  • SHA1

    42bc162033b0bac75023788ec1beebdb9a392c1c

  • SHA256

    13ddb045e1057b7b5dcdc961e5586ab2b70cf2e0b2b76263ad990134590c9e86

  • SHA512

    54a814803652bb192c0d452c8356aad148d3260b3e5c4410756b7aa609d047abaadf59c1eb2665e84b00801b53336fc0e028a10dba5df940e4df0f734335ed22

  • SSDEEP

    49152:uVOnPcC0V6qTfT3aYIB+0UmOiRNRu2eZ7j9RLUNKd8u0T8i:4CUFXTfja+tl4N83XuKdqTR

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2