Extracted

• • Target

    f0a25e484d3aa6d6fa1c5cb397d4b8bbb968c2ddaaf21b0a930d8edc12099925.exe

  • Size

    2.3MB

  • MD5

    46fb64b81ad095181093f7bebea75264

  • SHA1

    5b4becf77e6eefe07178a23672019ee96a34bb95

  • SHA256

    f0a25e484d3aa6d6fa1c5cb397d4b8bbb968c2ddaaf21b0a930d8edc12099925

  • SHA512

    b1c56fa8cbf9b940226f74819326103aee83b0b546443cf4e8d050ecaf39fe016c8be6fc4074ccf051e0e583a702aa03b33b8be0316c1c4d3b59fa57afaef62f

  • SSDEEP

    49152:fwaPhUC+YgXDZ40GPwOs7rtb1JLnFyNTDHjt5MxhlwB3AG/NYcTSDMKztcnqrQaO:fzUXhDZ49D2b7pyt7MxAlhTO5eqrQa5I

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2