Extracted

• • Target
    56646177e745d0aee40964b14fe96328ba2c9717d005b13e95846e14cf6e775d
  • Size 2.3MB
  • SHA256 56646177e745d0aee40964b14fe96328ba2c9717d005b13e95846e14cf6e775d
  • MD5 f0bbb859e902e02c59a201c1d888aec7
  • SHA1 918ec9c1b7ef9260392584e179df28104a626596
  • SHA512 697ce952574a9e22930565eb577717cf6e0edd981bd5c805656e8a0b907889e24cca4b71f77cf905865afa7ec7fc46bdd6022e0e45cf9d3e8733f22626ede7c1
  • SSDEEP 49152:0kmKhyq24kI3qebVyK//iduGj2op5IR7JW0zD4D3BxBYKAFQaCYkCinlRs9:0kmKEqlkAbAWaduGOdzD4VxWKEHIlRs9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2