Extracted

• • Target

    47b67061c6e2824819ce42da6d5f96a6b6885f3d93e86776ae95335d74f7bd26

  • Size

    2.3MB

  • MD5

    989a77c64af04c2e10ad73cdfff22534

  • SHA1

    88f0e5d77b356eb09d17b454796e0d768d71c000

  • SHA256

    47b67061c6e2824819ce42da6d5f96a6b6885f3d93e86776ae95335d74f7bd26

  • SHA512

    489f165abc7e3754613c5abea2b67beeca07778fcd6ce3b49a12a2cebe792e96ec94082191774113eb5bf3143fe01584bc78cebaf0e04925262ccb12d2418892

  • SSDEEP

    49152:EkmKhyq24kI3qebVaoxPXES66vJnub8Yj+A20F7atHD74CoQjJSKL:EkmKEqlkAbkMYunuaH0F2jnD9

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2