Extracted

• • Target

    7300d25b963205316571f487ed033e835a4761c5a02cb14520be7cad2bff4268

  • Size

    2.3MB

  • MD5

    a4197b13d16c29326a3ef314053d1806

  • SHA1

    ad9c377f2ea8d0ba0f3603844d8f13807bd5f284

  • SHA256

    7300d25b963205316571f487ed033e835a4761c5a02cb14520be7cad2bff4268

  • SHA512

    44692f7264ea3c2fc17a2ff383c88f78ee4e9307c234b4709028e0d8c6cd70990792d7b90e97fd903844b6d0c0cd10e56ca0a0df3a4c06ddd745c3b760419b92

  • SSDEEP

    49152:OjdJjljWIIlGS3Z5n4O+wqVkaVX08GGx8aUUOnzJSA+1VpJB:23jljEACe+qVkaHFduzJSA+1VvB

  Score

  10^/10

  evasionriseprostealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2