Extracted

• • Target

    ef43b61027e5a4e340135de3a22797c333ed7d7f3d903b78975ead569fea1879

  • Size

    2.2MB

  • MD5

    7bb8cb30220fb9f995b100eb32965799

  • SHA1

    dd8b37f680ea762ae7e5d775c88feed065991112

  • SHA256

    ef43b61027e5a4e340135de3a22797c333ed7d7f3d903b78975ead569fea1879

  • SHA512

    cf423d29acdbee8e92b27f5d95c42053f5ed6528a5a3c8cc7bf3961e8d97571129c14b27587774bd910ae1aa34fdbad815a705bfaeea8b57124f2bbd7c5edc90

  • SSDEEP

    49152:CeF1xn14/7p1+XV2ibKLJi3vIVOxlXIknS+GbU:v1xn1wp1+XV2oKIfpu+GbU

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2