Extracted

• • Target
    678dae14ff7c7a4a35622403d21f5460ea4a865600722056bdbab6c07d223f85
  • Size 2.4MB
  • SHA256 678dae14ff7c7a4a35622403d21f5460ea4a865600722056bdbab6c07d223f85
  • MD5 9ba4f92bee29b29cb5cb0021043b868a
  • SHA1 ec32ee7e176d8c15844d217b97e3bbeb52ff374c
  • SHA512 d17b717ce8e3b38073ddc25c684dd5799037459cdccc15d7c15021092920055b66dfd91ef6820f0444a23f89da1fdfe41882bcd548f5f25da05c64f45b97a62c
  • SSDEEP 49152:wXQC//Ygi6CXHgCtym9rphQgif0/An+HzTZ3sH4e1p3PnFeb68jR0:wXQ6/jibXqAV+LJ+HzT5sLNPnFe2wO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2