Extracted

• • Target

    c8c73afb30a6684a4fb6de4e2080f80c9ac78f2debe70da5e6cab4f24e4de404

  • Size

    2.3MB

  • MD5

    565a2f6024c731cbaa9389e4c2899aa8

  • SHA1

    4af092241bdb5291e85d5951bdc4c19241a863c4

  • SHA256

    c8c73afb30a6684a4fb6de4e2080f80c9ac78f2debe70da5e6cab4f24e4de404

  • SHA512

    b9b795e48cf156bbffc5a461ec4cbbe0a6638582cad44d5fc7b173780b4e357d94672dd9aa985d50eed929903acf0fcbed01dca47fecea78ad444409edbd94ab

  • SSDEEP

    49152:6kmKhyq24kI3qebVa5NGOzjwosAgu6LNewol/HMK99:6kmKEqlkAbk5NGOfwovB6LToK89

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2