Extracted

• • Target

    e078e94cfa184c35cada865c7b507baf100f338bceb8cd6bebb65ab3c36c4742

  • Size

    2.3MB

  • MD5

    4088f95288e9ad05964a6f0b68108601

  • SHA1

    533661b0221ee7cccef7fc3b7994e13b9528e90b

  • SHA256

    e078e94cfa184c35cada865c7b507baf100f338bceb8cd6bebb65ab3c36c4742

  • SHA512

    87855915a2efc0dc2b8ea4ad641954a1c59a09882e6b8873c0557c1e69509cec2132d490bf3f458c5f4050caf2e8107bb27f277d528edbc490ed1b94ed8d0e8b

  • SSDEEP

    49152:dg69SebPPiKgYyuGOVW6UMobBreAlJmSUbg6BhNERh2GDcK:dg69SebiUlE6xmBSAlJm5vhORhAK

  Score

  10^/10

  evasionriseprostealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2