Extracted

• • Target
    c8c73afb30a6684a4fb6de4e2080f80c9ac78f2debe70da5e6cab4f24e4de404
  • Size 2.3MB
  • SHA256 c8c73afb30a6684a4fb6de4e2080f80c9ac78f2debe70da5e6cab4f24e4de404
  • MD5 565a2f6024c731cbaa9389e4c2899aa8
  • SHA1 4af092241bdb5291e85d5951bdc4c19241a863c4
  • SHA512 b9b795e48cf156bbffc5a461ec4cbbe0a6638582cad44d5fc7b173780b4e357d94672dd9aa985d50eed929903acf0fcbed01dca47fecea78ad444409edbd94ab
  • SSDEEP 49152:6kmKhyq24kI3qebVa5NGOzjwosAgu6LNewol/HMK99:6kmKEqlkAbk5NGOfwovB6LToK89
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2