Extracted

• • Target

    3be29e2911929f4010cd8c36d3e56ce2f30e2c6c03f62f4ee95458b9799ae600

  • Size

    2.3MB

  • MD5

    c7fba0bd47207bdd472c46b45ad067d6

  • SHA1

    72c5f52125ccea52efed358980d6d66cfc669d8d

  • SHA256

    3be29e2911929f4010cd8c36d3e56ce2f30e2c6c03f62f4ee95458b9799ae600

  • SHA512

    52c021024bcc362a7055d33217a33cc82b167a989a44e9e4e5a9f37f4cab10a08c74a751e3c4391e4bbf0206f0fe71ffa91bfcc26bd60bc21402d7b7bfffe003

  • SSDEEP

    49152:ig69SebPPiKgYy0YkCUhkYTQSY80JryTE+Kz5G:ig69SebiCQSPa2TnKz

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2