Extracted

• • Target
    3144ebb1c25368ccd0a30dbeed85739dcc7180e7ec365fa45362f6331d881b8f
  • Size 2.1MB
  • SHA256 3144ebb1c25368ccd0a30dbeed85739dcc7180e7ec365fa45362f6331d881b8f
  • MD5 2b5d45fc67362a404f37628b80b37d72
  • SHA1 625cd7642f65cdfdc04734098df3c10a1a9d687d
  • SHA512 225452513f63ba4489aecb496a27874a4ff1dd1d69e6c4e444a38a81a71b5f374b3e7da5a8a801368e773a960c894780435a23abc1811c92768fb8f8bd936bac
  • SSDEEP 49152:ySUl6vD5DxN6HHLJ9tjq6kGG0YGt6Ux4fFHuk4bN/+SS23o0guwsPqv:ySSwD5DxkRqrG6NUx6AkIN/C0MsPa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2