Extracted

• • Target

    44f35c82824fb5027bbadabd6199c7e361ee435d008bcd5064afa9caa5334c6f

  • Size

    2.3MB

  • MD5

    2ff2cf033473322fee8026316968ae50

  • SHA1

    3f51ff68ad0f28f5f812b55f26235cd8cfd402b9

  • SHA256

    44f35c82824fb5027bbadabd6199c7e361ee435d008bcd5064afa9caa5334c6f

  • SHA512

    f2157e2444df7f9c085cef25ea8a9b61c8541a7212498209b2632829834af665cb554ded4321c89706823558a58544b90d8e3fc69e78118533d22751ed2e0ad7

  • SSDEEP

    49152:LiI6T9RIvYzqc7YJ43ECeYqDQCyt+zGbt7wi9aUCZSznvASrN0+rxgdpPAx:LiI6hRT7YuEClqVc7w8aUCwnvBS+rxQF

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2