Extracted

• • Target

    a5cbfe211d574420560b50daed3e9e1dd553935c114359202a94f3d6c303c9bb

  • Size

    2.3MB

  • MD5

    c604b50e7f6202f93dc743770caa0c1b

  • SHA1

    cf91df2cd72901705cd68fc2561d239a42055672

  • SHA256

    a5cbfe211d574420560b50daed3e9e1dd553935c114359202a94f3d6c303c9bb

  • SHA512

    582dc0906e5be21ee1a4d6a0ba8cf56d6be7d9a4e617aa8f1ed97a01d79ffcbbae7328282fc477ee418f0065b065e602bb00ee753db4799dfc1eb77ea81a341b

  • SSDEEP

    49152:IkmKhyq24kI3qebVawjZcc4TJPKcX1Klz717D01OB5:IkmKEqlkAbkTc4FKcQVkO

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2