Extracted

• • Target

    e2109dd1afe113b0bbdb9c117be85694c54cc26c1f59ef5fbf36ca70187764ed

  • Size

    2.3MB

  • MD5

    803a6c4ceeaef9d56bc7858abcf8d525

  • SHA1

    1e62ff9793c776a2c42080a15f60da2cb7199a07

  • SHA256

    e2109dd1afe113b0bbdb9c117be85694c54cc26c1f59ef5fbf36ca70187764ed

  • SHA512

    d6dbcac5968e9433a10099f12670067d1e298ea6d3cc0a762ceff5ab8d5f8221f1c00295e102b3d7d4993ce68d874ed24ea761847d8694ce60361db8fb01726b

  • SSDEEP

    49152:Ob7sH7qcORTVz2klvijpRAi9nNxCt7Spvs9phNisetYvKF3ZP:FORVz1dGpRAkCtGErhN0tYv+

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2