Extracted

• • Target
    b3363652a0ca00736b3bc0cd3ce060cf4859706c065bf242adb41239bf2f3c3f
  • Size 2.3MB
  • SHA256 b3363652a0ca00736b3bc0cd3ce060cf4859706c065bf242adb41239bf2f3c3f
  • MD5 18ff9c2a039aa69d41beccf0ff8530ce
  • SHA1 9651c42703e9672cb3ef25befb4952d44a4cd53c
  • SHA512 6f210bc84e79219aa5e9db23ad52cbd579786daf9def0c21fc8bb76f5e996a52a89569fe7bdbf70f26a23bc87944b7220ab41400b10d4ec146f521ccae7b96b8
  • SSDEEP 49152:+czhLgBHrI4I73U3dtKCV+eHrmf5nGtqQyPVXeWKDaYe3:+czh0BLI4Aktt/0eyZGtq5PNePDaYk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2