Extracted

• • Target

    41da4e2ec5dd0a6703774eef1f93ce26342e45aee39fa820c6f9ec4b04c1bb9b

  • Size

    2.3MB

  • MD5

    9c199d10df799013027a3432dc09f2aa

  • SHA1

    0f8e7920f72850bdcb809e01a18ce532c830ab0f

  • SHA256

    41da4e2ec5dd0a6703774eef1f93ce26342e45aee39fa820c6f9ec4b04c1bb9b

  • SHA512

    3ad1050fb4916d676e6e64e6f434825659f38ab1185ad1a89770753fd4830ba3e1ebad99bc46533a506d04f64b245b42a286105f4d60c64e399bfe6c01a37608

  • SSDEEP

    49152:KPRdlxj1Y546FN+l0SPpIXcNN2bWJs+ic55c5J8NaE5v0B00c:S7lE54vuMXJs0cQNaKQ0

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2