Extracted

• • Target

    1eb8f14ed07fea706e973d626e3aec93cf1677cedb59ee44d5f1e576b157b9c5

  • Size

    2.3MB

  • MD5

    3a48730265290380c2738c7986079fc1

  • SHA1

    d71cb115ee4272431c61927f29c184ff4258735d

  • SHA256

    1eb8f14ed07fea706e973d626e3aec93cf1677cedb59ee44d5f1e576b157b9c5

  • SHA512

    9efe244ff749d3b40613aa4136c17776e9886b2bf58156230a075d143df3edc32be59752d83f030981e3ad786dc6c03cc026319cb30ed99fc88882c3cba0c125

  • SSDEEP

    49152:iGY5918NqwTEgTccpMGPXw2w3NMkFUgyO1Zmqg6sMvCYnBU7:zhTBpBXRkFUd2ZmxvMfnBU7

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2