Extracted

• • Target

    9cb829249b9e09b3d0a4ac34c2a12c493a850f183c89bb67d627f39d73e1adfe

  • Size

    2.4MB

  • MD5

    8980dd76aa0b32e2847eb2c9306e2357

  • SHA1

    48fc503fade749634430bfade7a76afac7b4e3e6

  • SHA256

    9cb829249b9e09b3d0a4ac34c2a12c493a850f183c89bb67d627f39d73e1adfe

  • SHA512

    1542828fb817d8fdced04097a93b81111298dffff4db04ca071f4897178f74b2fc10377b55acc5742a5c946716b7077fd21154af7f9e481396086e2517df7125

  • SSDEEP

    49152:haYhAZmuPFgFCv8Ri5YAlnIEtimlnAhmv2qAB5aRqP3X:haYhA8YqFCvhhimGVqAnaRq

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2