Extracted

• • Target

    8570fca54d8d97ef0050d1b6210dd2af476f30386ccd3b74e0158f2c50e3af09

  • Size

    2.2MB

  • MD5

    dd5c5965deaae1c42f458029d13250a9

  • SHA1

    fe8fd3981d76e2a0aa26fbb2dd1967c5a3619b5c

  • SHA256

    8570fca54d8d97ef0050d1b6210dd2af476f30386ccd3b74e0158f2c50e3af09

  • SHA512

    20162294a5dc571f722a3eacb0e8eadda1c5a60c60752f142ee9c6226d1c717f49d303e55836cfd23e91b7b991130eaeeb319f72d67b26bfd7a0b1c0be33f10b

  • SSDEEP

    49152:ikmKhyq24kI3qebVyKjYiVOcMfZjI+F2qjqBsyzS/I2r4i8tjW:ikmKEqlkAbAalVTMfZjI+F2mqFzS/xmF

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2