Extracted

• • Target

    5c118e503a9906ba1ab961457554bc84173b7ae73ea7bb0c3c9256c580d886d0

  • Size

    2.2MB

  • MD5

    f6ccb2e2c5877bf4b63a1a1421de499e

  • SHA1

    b013ab58bf783ca68e065c5c2e4c8e4b62acd704

  • SHA256

    5c118e503a9906ba1ab961457554bc84173b7ae73ea7bb0c3c9256c580d886d0

  • SHA512

    d3acedd6e7352556e8173e08d9faaf65ba65c49aee8590edc14e6c1ff84e9641790444e4ee6446fad8fd7f2fbc24be9fc79e35ff35e9a2769d8e3963c7c5e816

  • SSDEEP

    49152:heF1xn14/+p3ajgEUcG3yxuwkNtbQfexLCOkVU:U1xn1Xp3EGixmAOgU

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2