Extracted

• • Target

    c7787158a846342071ed9c7de65eeb3ecac245bee424298f61203b35b094eb3d

  • Size

    2.3MB

  • MD5

    73e06e8f6d8117f4119a680223c5a20a

  • SHA1

    96e13be7c6ce657b050e81c8215b7a32b4e25688

  • SHA256

    c7787158a846342071ed9c7de65eeb3ecac245bee424298f61203b35b094eb3d

  • SHA512

    7786ff5e81f669bceeba84ade9ea6adf1466aeca4203a633e145cc463f9183be51c8b1e4f3183758ed3af08c6aa32dc084d9e88828caeb9510c30623bef5b763

  • SSDEEP

    49152:6GY5918NqwTEgTcQ8XMV80K/TuhGyRLtGVzVYnnJ5pGqBGQGD1Ygqb:bhTP8XMV80bZ6VzpY7

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2