Extracted

• • Target

    174005db70c1b4889b793121b17a6cb0ab2fca6bb52b9142bf429b6a239e0551

  • Size

    3.0MB

  • MD5

    b5333ad3722cfa72c4b691dd5d1c677f

  • SHA1

    a4e122a8e5e28bf44d155c0f877b1f1788d449e6

  • SHA256

    174005db70c1b4889b793121b17a6cb0ab2fca6bb52b9142bf429b6a239e0551

  • SHA512

    5cc3565084296b641c7a4033f3c7cb5bb995dfe2f44a5c0dd89c3ab52ec029672499c6cdb3d523bc06c2bc72d21cac68d04f20099391502f91d16f44ab063314

  • SSDEEP

    49152:AQdN4YQz034J9/HnArWLKZRm9pUuT240wD//tSyfwEDgS:tdeYfs9PnArWLiRopUo240wD/X90S

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2