Extracted

• • Target

    60fc79c1b620061264305d58d262528dbcb3443b6d13ec74726a98453f4d4b2e

  • Size

    2.3MB

  • MD5

    75251316071af21547ae32b67f5f5f6a

  • SHA1

    7c5a4557493a378f823147a304755a9698403542

  • SHA256

    60fc79c1b620061264305d58d262528dbcb3443b6d13ec74726a98453f4d4b2e

  • SHA512

    f5ceb8beb0b9cee3bff34971249f2a205f9feec890bd493afafba34b32fe42e0d344cad3b26e1e45d6b10405f106dbc9c3a5a7cbc88170e7de9b8fd2cd068011

  • SSDEEP

    49152:uz58QFIcLvII0ViBkboRyXLIcX6leJaLGsO8P2Yj3K5WlLb:mt9dmiBcoWQO9sv7aAlL

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2