Extracted

• • Target

    e511f5f150604b743cc65dc107c2204d9bbe72f55a87c8bdadcf24f10ee9515c

  • Size

    2.3MB

  • MD5

    c3eb34e79a7352239b5330bdb1187036

  • SHA1

    b2da94d606403b057a13712b8782e4b66585c7aa

  • SHA256

    e511f5f150604b743cc65dc107c2204d9bbe72f55a87c8bdadcf24f10ee9515c

  • SHA512

    faf8104642651b29596b8297b5d4c86e15030bf172625cdb27c19149542a7a16a0bc9e7c835b7d5495df0069f505e47e527865f92a6435b86f261ef5d5e3b212

  • SSDEEP

    49152:ORf/h6SeKhWZqnt698/xsCQorhimXp6dAXpabIixyur13XwgPG:ORfAmRMm5ab5xyY3gKG

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2