Extracted

• • Target

    bd2121f85a4f7cb088c427636f6fed7e02ed42d94e568f6de376be1774885fa4.exe

  • Size

    2.2MB

  • MD5

    a16ae21452d2bc3fa746b98858e504c9

  • SHA1

    2719a638efd47cc5db565a8fe2b9b0f109845da9

  • SHA256

    bd2121f85a4f7cb088c427636f6fed7e02ed42d94e568f6de376be1774885fa4

  • SHA512

    e937e4d6caf36a6f42577ca9177398e44aa37783120131a76fc8a054180739dde476b5773253c1e1e0b696791470c3262395dec6d9a3be871c2c216b44c1b9c8

  • SSDEEP

    49152:usJajYd6fpPfzz5lmFhSBt6jG6fyriTqxUmUSbWTdpY:usJSfpzzaE4jGGyJxUmQA

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2