Extracted

• • Target

    1cd018b7b78544e498cb0a8108f9c44453db406911553668a8a1947c0445d4bf

  • Size

    2.3MB

  • MD5

    1d3a45554868b1c7d67284473ad6de75

  • SHA1

    8d909ea73151bd066ca5422f8da8a8fc1631c0c3

  • SHA256

    1cd018b7b78544e498cb0a8108f9c44453db406911553668a8a1947c0445d4bf

  • SHA512

    cbe060620568891a47cab1f509d18131dc77f075a6938af75402c2c5d9eb823421c9594fac9a5eb2577ec637c2a96a86d77ca041b47b3c694443736d49c7166f

  • SSDEEP

    49152:1GY5918NqwTEgTcHxEmQzpL6RoI7Jylu2WuSgyBf8eaLnvSlw+IVVe:qhTeEmS6RoIcdZS/oDvSY

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2