Extracted

• • Target

    be6af810785d957322e2abc90cccfb9e42ba46808b1518e742a1313925267fda

  • Size

    2.2MB

  • MD5

    8aa7d0bfdd9dca71dd0026c01bbac9d6

  • SHA1

    72cb3100e0eac69761c6c657950df27161606c69

  • SHA256

    be6af810785d957322e2abc90cccfb9e42ba46808b1518e742a1313925267fda

  • SHA512

    6bc655135ae80579ce74409545a777850d1a87e3d4404df6562528b2f62252c913c961b7e96affb954739f427cf85e5d8b6b6a6f1e616939cbc346d4205c6b5c

  • SSDEEP

    49152:bkmKhyq24kI3qebVaVAOMBoOobKLJT0TUfWO9IRqpZoVZQ6A:bkmKEqlkAbkVAE5G1TiUfWuZpwe6

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2