Extracted

• • Target

    30256dfb3975dad2c6523434662cdfe39e2c99c6eaed5570b0f6095067e78c9c

  • Size

    2.3MB

  • MD5

    d67499cafc4e41e967620692c5edfcdb

  • SHA1

    368d1d7470242dc16f649db0e6db07e91f56842b

  • SHA256

    30256dfb3975dad2c6523434662cdfe39e2c99c6eaed5570b0f6095067e78c9c

  • SHA512

    5be9e84289593ec91113070b79f9247ce91d1b3eea40996f79d2e7f015a13d7858b0687a3273e6635315148c3f089b823cd076fbcbbd1ae55e7b4661f36f6566

  • SSDEEP

    49152:UkmKhyq24kI3qebVa4Uo89bvmwIgXwKpIGev8W0dMIMaRwZAdVQWT:UkmKEqlkAbkLo89b+tgXw+XdjeZFW

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2