Extracted

• • Target

    235f9c180b1911264846b2e003c306f8aa0a3ed3f1ea968bb15ffd7788bb95a3

  • Size

    2.3MB

  • MD5

    c5cd83a0c9fe4d9341c8aafaaa197879

  • SHA1

    bb2461647f8b38ed64a47b19991d317e44cbd7be

  • SHA256

    235f9c180b1911264846b2e003c306f8aa0a3ed3f1ea968bb15ffd7788bb95a3

  • SHA512

    f55660cbf4ad43148f6e182165fd7461da59ead2228f5a3dbc067837d94f8563211b783a0a222f3e706dcb2847da2c116ebefe341b58a0923aec521700213bd9

  • SSDEEP

    49152:YGY5918NqwTEgTcQ05RE8FLQYQAMCDY0xTUczn9eE:5hTPsE8pQ9L02cj

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2