Extracted

• • Target

    850f63933ca91eceb498a3f50c77c9c5b29da13eaf39da50bceff772106f2f66

  • Size

    2.3MB

  • MD5

    6c028841ac02b8a9ceceb69d6189d24d

  • SHA1

    c9372ab93f55b9698d6ccc10067b24058df92fea

  • SHA256

    850f63933ca91eceb498a3f50c77c9c5b29da13eaf39da50bceff772106f2f66

  • SHA512

    0ddc8e14adc0ea377e00db370c8793160d5d27a1c4441874486fabc49bef7bcb370f77ef61142b37d670edd0811060d45a569797d77a41425c6694aed07d61ad

  • SSDEEP

    49152:ikmKhyq24kI3qebVanrBV3K6HVn0k/PhJpTDRLnBOYdftuInsk:ikmKEqlkAbknr3HV0KPh73TuIn1

  Score

  10^/10

  evasionriseprostealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2