Extracted

• • Target

    5c13dba5f5db053658b63279262ef5e2df8845cc49abea2d76ddb435c4df559f

  • Size

    2.3MB

  • MD5

    a07ade11dcdef47cbf26408bfa10f983

  • SHA1

    0b99e4fdd630970842e6d53df909987846820ea2

  • SHA256

    5c13dba5f5db053658b63279262ef5e2df8845cc49abea2d76ddb435c4df559f

  • SHA512

    7b82947354f97976f4d723c99bdc89f13e1182b9e1bcb47ab65a2605f4f63eb9b51a16719569c6e6281c2898b2ddb1188edb851593c1f8f8cf7cfb9d27f8aca4

  • SSDEEP

    49152:aeF1xn14NuXWjujj1zZh95YW5btccaopMK60kGT+PZ1U:H1xn15XWqj113h5cDopMKmGT+R1U

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2