Extracted

• • Target

    6fcffcaa1d226a376087481a357756756f2d34a1e28e3ae06b717ac25d87c3ee

  • Size

    2.2MB

  • MD5

    4946d5f715f65f404f7d87ccf82226df

  • SHA1

    7c45f636c4d40f1faed98aabf6b1f78258be3798

  • SHA256

    6fcffcaa1d226a376087481a357756756f2d34a1e28e3ae06b717ac25d87c3ee

  • SHA512

    023d3312a87f0af82647d99346b61611a96847e641d230f7443c3a38a7d6abf72a17dea304eed2dd4d385d53e79d576c2924227be7be1ac3acfb1c5068c8ab79

  • SSDEEP

    49152:RkmKhyq24kI3qebVaCy3AaiLoHj5Bk+foqMl+UySnQY6:RkmKEqlkAbkCNaJ5+l+FSnm

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2