Extracted

• • Target

    e960960a6567883dfb62adfc6a6a274e726a6735cc9fa00d4e225ec523c22fe0

  • Size

    2.3MB

  • MD5

    ac380cff4c1e920beaf780727d2b97d1

  • SHA1

    eec363ea3e623c64240b59b0ab61444f88553638

  • SHA256

    e960960a6567883dfb62adfc6a6a274e726a6735cc9fa00d4e225ec523c22fe0

  • SHA512

    4e0b3c400ae9997e7596efaad403f9cef4e5af9490720f3b84fc666491832fb8cd276a0325bc86f971dddd587420078a27c44dccb8c995e0b0c26ae8ffaf8224

  • SSDEEP

    49152:cGY5918NqwTEgTcQOo6ksySiRd/3m/WAnFN/KamzJNHUUH5aF:1hTPOopFRR13M0am1tpA

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2