Extracted

• • Target

    427d249e5d3a3d1e35996f312f8f50a2cf0fc0a442aa2ce772b5eb9b8a824f82

  • Size

    2.2MB

  • MD5

    fb572693dbeb1fe07389400383d4614e

  • SHA1

    33a4900e2bf43594dbeb8649e520beb0b19ff467

  • SHA256

    427d249e5d3a3d1e35996f312f8f50a2cf0fc0a442aa2ce772b5eb9b8a824f82

  • SHA512

    a7a572f09395a6b30104a0f00c57613956494ac71be471fb70d1268dc7d55d6ebc3e2850e3b2c481cb447be827b58c2837dc0ead2be84236f7c9ddbe8687150a

  • SSDEEP

    49152:OkmKhyq24kI3qebVaHy4kdoc9/vvA5K62DPMdShov7HULWJqYf:OkmKEqlkAbkS4E1FA5xiPMe0DTn

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2