Extracted

• • Target

    0439e2c1ee7f2dd159ab81b86f6834b66ed35b4e32f02d380ffa20c1413e25a2

  • Size

    2.3MB

  • MD5

    7a36a575996d7b9eca0c66e7d4d077c7

  • SHA1

    d7b4b835506782892443802a31d866fa89e61e99

  • SHA256

    0439e2c1ee7f2dd159ab81b86f6834b66ed35b4e32f02d380ffa20c1413e25a2

  • SHA512

    6d96c4a8b370e2d63f2402513b3a143578882e1152bb3f2bbb5a1cd077835b165ee3ad260d66ebf23c50d69f1aa21f747a8d3e2521c56a3c0c8185d694e25991

  • SSDEEP

    49152:2iM+Wqkr/txRYHdp1TDh0H2Yh4uPwcYMsSx6gjIFEYAXmguvS3PZD:2f+1XHdpNqh4unf1IjGmVvS/

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2