Extracted

• • Target

    ae4c539845660fbb61bd38ca59f3e23b85086d615a52430e2f18aa6633e013d7.exe

  • Size

    2.3MB

  • MD5

    772864f4649fd320b44ba2265f8e513a

  • SHA1

    fd6ff39a203be914fae6346caf204e455d629960

  • SHA256

    ae4c539845660fbb61bd38ca59f3e23b85086d615a52430e2f18aa6633e013d7

  • SHA512

    8c9bbbb53d5de53d40b47323c08991f9b5a127589492427e78c142ec88b2985c0d472ed044051a82da909c13aa086cc6865c8024bc67a95236d8634545a204bf

  • SSDEEP

    49152:p+avxJi/wj5IzQcGVCza9CW4UUfnIFRZauw1OiDImbI2DEAJE:p+iAwlHIEtauIPIgdC

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2