Extracted

• • Target

    f09ed1936964c63fc8dfeda5d6fab7a1699995ba6bda3b3fcebb884d640f6204

  • Size

    2.3MB

  • MD5

    7165e6cb93699d6ae2e685ff6d964c77

  • SHA1

    29b287f84095f845e32021ee4ca5f3163496db71

  • SHA256

    f09ed1936964c63fc8dfeda5d6fab7a1699995ba6bda3b3fcebb884d640f6204

  • SHA512

    bf3eab42cd6a7466b23c06ee83b46564a041889bff137445999a2ab92458c51a1c507bd0df42e97e9c15739818fa526f17df0ed4038d8699d4d734ff0619dfb3

  • SSDEEP

    49152:wCHtPr/uNXysmo+uQGda9ABh7vZvlB8MRX503wxKO1CfcJeLOqoKBEZPp:Fd/cXfmo+TGd5r7xvlB8MRlKO1Cf6qoj

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2