Extracted

• • Target
    ae4c539845660fbb61bd38ca59f3e23b85086d615a52430e2f18aa6633e013d7.exe
  • Size 2.3MB
  • SHA256 ae4c539845660fbb61bd38ca59f3e23b85086d615a52430e2f18aa6633e013d7
  • MD5 772864f4649fd320b44ba2265f8e513a
  • SHA1 fd6ff39a203be914fae6346caf204e455d629960
  • SHA512 8c9bbbb53d5de53d40b47323c08991f9b5a127589492427e78c142ec88b2985c0d472ed044051a82da909c13aa086cc6865c8024bc67a95236d8634545a204bf
  • SSDEEP 49152:p+avxJi/wj5IzQcGVCza9CW4UUfnIFRZauw1OiDImbI2DEAJE:p+iAwlHIEtauIPIgdC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  evasionriseprostealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2