Extracted

• • Target

    5e2ae541e25d87cd6731ddcf030b7cc853264723c0727ca7599a57b0a9cec7c6

  • Size

    2.3MB

  • MD5

    ba2818d841e1e481ceec34d2cbe67e16

  • SHA1

    e8707612babb6c111d2bd1808be535d5335377e2

  • SHA256

    5e2ae541e25d87cd6731ddcf030b7cc853264723c0727ca7599a57b0a9cec7c6

  • SHA512

    9dcb2cdf091e0e9dfe9b1505bd729adf67488689a43fd0050e68f5c7247979a96c94ed95deeeb1eeb0c355e33150fe10a2ee1d2d815df0a2165a51d3b50e5642

  • SSDEEP

    49152:efNYyhPNfMGphcnhnl4GNEP8todCO14+dNMQNvh7s5eHNzlqM:gXWfd+bdJ59JtN

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2