Extracted

• • Target

    71aedc9866a19f8b4b24245196ca0eebf4aed41bfe6fe8d84dbe6ebcbfe0e7eb

  • Size

    2.2MB

  • MD5

    4b0d0c94d11cb1566e4139e3a8897af9

  • SHA1

    e627fe1a11f5489b5c64f3102158f673a5c9f55b

  • SHA256

    71aedc9866a19f8b4b24245196ca0eebf4aed41bfe6fe8d84dbe6ebcbfe0e7eb

  • SHA512

    7eb1b84591a7eb9cb31b36cbdcb9a7a8d361025aa4338fb5d573b969592f7b2c9bb33f3794ab34f992e232eac6c10c2e92d8b8cc3e16c1e5955f6b7fdcb2f455

  • SSDEEP

    49152:2eF1xn14/0XXZLxcN65P2H6iWfy7TsELN6aKG2UUNBwJbTCa5U:b1xn1XJLxcY5gWf4xQGUnEOYU

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2