Extracted

• • Target
    c578e5acc36663dbb86608cadac57e70de21a6cc217a9e461eee5cb9038c21e2
  • Size 2.3MB
  • SHA256 c578e5acc36663dbb86608cadac57e70de21a6cc217a9e461eee5cb9038c21e2
  • MD5 38c21a65b353891fcf48a6ba7aac8d02
  • SHA1 ef0192eb1f1933bbe9fff2de5b9017a0c7d70149
  • SHA512 2b96b0ec95387851eae66759991fae9fba4bcf84fffc5a81e9808122e65e45a09ac21ac5cca3d43a9ca01b5cea014809f0244f68272e71909ec70cad7b55683f
  • SSDEEP 49152:reF1xn14/UdIymyt8PE//tBH5M1D4DLOUp336iiQAU:K1xn1ZOyePQmeHp33EU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2