Extracted

• • Target

    3361fe4b6f365b1df2b53472e005ab365ad94be87888f659bdfda3af24dcdf12

  • Size

    2.3MB

  • MD5

    7154f7f38c806cfdcf8a593a1a9d29da

  • SHA1

    7594597c61090519126c598b29dc3d3c0886c3a9

  • SHA256

    3361fe4b6f365b1df2b53472e005ab365ad94be87888f659bdfda3af24dcdf12

  • SHA512

    b5acca76aa38024e54a8f78922c160d3c43e53924c26aab81a2627260104ccfedbaf301fcee385d59a15a1bfd3d05b3ac0d3016d8d8b178b23f34e8f2304c6e8

  • SSDEEP

    49152:0xkBy/YYTZj1OzKvWopcP9iJWtALGSNq9CuUzSxIQS1aLdFu1IEUzNnY:CkBy/YYd4zUW0cP9UwdCbNQxLdFSUNY

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2