Extracted

• • Target
    8a969a2d57f56068dab8431f775a53045a83a5ef3b53c3afbad9050adfd4cf09
  • Size 2.3MB
  • SHA256 8a969a2d57f56068dab8431f775a53045a83a5ef3b53c3afbad9050adfd4cf09
  • MD5 9c0cf0f69999527388e4cd0ecef7f225
  • SHA1 b6e439213ec66b594be41b93498d01ffdf367732
  • SHA512 9c4414683056f1303b75d1c83f54fbe9e5aafe4672ca3c464f70b034ade29efabb975fe525d8a3c26d4438e829ff1557e9d5a79785695164ce02b4d8540a5ad4
  • SSDEEP 49152:eQGpiLzCpsNgVl9sk0Xd2UdF+2m88CxRESzYSr++vmbAc+v:efYOP9r0XdMy3E8rr++x
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2