Extracted

• • Target

    2f0635cdac8ced40f91aa794cac88c062f082c5540034f5759dc52364419d35a

  • Size

    2.3MB

  • MD5

    8b3a03504221fe53231d4684acbe683f

  • SHA1

    42e206e92d97f5aee25368baab1861e044ad44a2

  • SHA256

    2f0635cdac8ced40f91aa794cac88c062f082c5540034f5759dc52364419d35a

  • SHA512

    f09cbf6225119bc4445a8d4285914e4e6521dbd2b6746d9e7d7180debc3dcd23a5a79f68646dc11ea6f3bd0f318769f4708cf5f3fa5e0759e4eb59f83793b786

  • SSDEEP

    49152:pfNYyhPNfMGphcnhnw0zo7H8W9Kw1Y/17njDlKi6mZ52HMeXhGCt:NXWe4/NwgnjDltF

  Score

  10^/10

  evasionriseprostealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2