Extracted

• • Target

    05b27cb01754546e5d896f174d308a90c396e3ad58b6127cc08ffdf8cf495349

  • Size

    2.3MB

  • MD5

    357bad44ce515a3e9c6db09a281c72c7

  • SHA1

    1d5acc92aa079b4f105bdfccad1a34b6a7f8dabb

  • SHA256

    05b27cb01754546e5d896f174d308a90c396e3ad58b6127cc08ffdf8cf495349

  • SHA512

    264d428d9e038c2a8687c36a093113deb820691fa81a8cbac9cb62778eb1df373af32d76a203e3ce526f204d4460e72df97e808d214cf2cf6df6fd0e1465bad6

  • SSDEEP

    49152:IGY5918NqwTEgTcQU8qOqfy95HYR4TV4rw7koidKRAmY:phTPUvOb5HS4TVMwooZAm

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2