Extracted

• • Target

    41bb880aec0f5cf5058b634ba751e51aca74cccafeb6b00e20f7a1f933205194

  • Size

    2.1MB

  • MD5

    8cc3960af64e8566c41e26beb65e6845

  • SHA1

    ca05775942f7ba9c337c38cb056509da5f6cddfa

  • SHA256

    41bb880aec0f5cf5058b634ba751e51aca74cccafeb6b00e20f7a1f933205194

  • SHA512

    eafa388d485257979b17e52c2e84f01f4b5cd1ead6bd96745a24ab1a6fdfaaf03ef20db99c2647d841ce800f866bddab030f313e3a8513f3fdfc5e23c178df3f

  • SSDEEP

    49152:bSUl6vD5DxN6HHLJFwcIgvsC4OGaIruwBgb/PQRj0P5pc4tR+:bSSwD5DxkTyJruOgbHQk5p

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2