Extracted

• • Target
    39cd18904b3a591ad4c70f648e2fb5306eaa634fd6f80bebc2502203226278c8
  • Size 2.3MB
  • SHA256 39cd18904b3a591ad4c70f648e2fb5306eaa634fd6f80bebc2502203226278c8
  • MD5 4b8e56f059818e79849b41c001b838e7
  • SHA1 36efd69ab1fb8f82e9b0de5ab319a3f19bee0e84
  • SHA512 ca777b5b9f09f5edc6dade676dfb07c6932f1dc7f8be686e14bda4b340e029adfdeedd36485971c342b0cece00fd7d93bbd39ed6e2a3c2dd0ec0890d6ad51e1f
  • SSDEEP 49152:CihYKRocEi6ziGSKVcK12zTutpJducyLXeQjsXOkO3lLeGI:lNRoDi4cO4Tut4DrjcvO3lbI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2