Extracted

• • Target

    81eef8e03d9e5bcfcbb20113c49e642e725d0da9bfd57ac352a8160d044d5b02.exe

  • Size

    2.2MB

  • MD5

    6020906ad6408fef253f61aab74905cd

  • SHA1

    955a943cf0d9ed7744bc05cb8751656e0ddfe69a

  • SHA256

    81eef8e03d9e5bcfcbb20113c49e642e725d0da9bfd57ac352a8160d044d5b02

  • SHA512

    1542ae1bd49b961d143d254977d198db5c9a33d557b7e5a6a19d636e4e5e0eb8752b70f7a602a96be29f1d16072ed0c2c6b8fe7f617a6610f508a28020a186ed

  • SSDEEP

    49152:dX0JE5Ubt/2A4fHtyVjQLn0XcFi226vN1ElY9orZVbpTGcSv461yqnWj3M:dXF0olHtGjQLn0y26sbpCXJwqUc

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2