Extracted

• • Target
    f46f25257fb6e60d19f384846723e1d92bf664a8d1f8cbeb3a3e9ff6a0e1cc50
  • Size 2.3MB
  • SHA256 f46f25257fb6e60d19f384846723e1d92bf664a8d1f8cbeb3a3e9ff6a0e1cc50
  • MD5 26d2ec2226c687cdddb71d979faec59d
  • SHA1 5db33b5584372652f541da35feed6f3ca766a901
  • SHA512 7018729defd64e1ec2dc382de9e2a9a3b5a9a5a882bc61b16bf4ad1ffcb0bfa508dbf889941e68f9176166d7239f34f6a461a7fa408216355366f40036382191
  • SSDEEP 49152:+9BxfCISmvHHDydN/kpKHIeV0VbNDthq+D5DYeUMvp4buF5a:+AlmvHDZKoeCJtnDTUi4yP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2