Extracted

• • Target
    SecuriteInfo.com.Trojan.PWS.Stealer.37069.25495.9561.exe
  • Size 3.1MB
  • SHA256 bfd15bd50a027e7ae0651d17670d195f02cc7141dc48b1cf2fbcf974209aabc6
  • MD5 a5b3f307e78a5842d2c97986c0b56f92
  • SHA1 435cd879719a41ee47cb8cb3ffff7cbff6d4f6e0
  • SHA512 3ed8439550dd5b5abbca7415c3d48dec9c47b2b458995a6299f0d6a14dcdab8e2b72e3e249887f19aedae119d304fab117fd6c192d722eb50b669275c0c60cb2
  • SSDEEP 49152:9KH3PgaWcmw2y/mitosRde7mrAcBMaNYXgr:9KH3Pggx2y/mitosRamrlMPQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2