Extracted

• • Target
    7106ca79f3ad742d9a48716b6f80114d.exe
  • Size 2.2MB
  • SHA256 ea8d16f2b82b3951c49f376aaffe087650a86e33bc4e90f154d880689c24c6d5
  • MD5 7106ca79f3ad742d9a48716b6f80114d
  • SHA1 14ee4d061b3a0014ee2bf49c7d5b9723a6f7965b
  • SHA512 e755335c1eeb5209460efe2fea8b1ba0a181be9e4770cf38e591716db8df76cb8a95a0d6930085d2bd04c2ab03da232caea9a72bd7bb096f33d1845c9ae7b33c
  • SSDEEP 49152:0SUl6vD5DxN6HHLJFwpDI6FIQd3RyfZRORXxzM1CBLl8UT/+:0SSwD5DxkTdQdByxROBtM1EPT/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2