Extracted

• • Target

    a2647c6229f7ce010d0782835f2e428cd783573d20cc01aca8df09c6fea75f68

  • Size

    2.4MB

  • MD5

    1425412063e84dfaa1b2d75beba00574

  • SHA1

    a8cc331f74509a4c32c057a674a3b25c7a12a904

  • SHA256

    a2647c6229f7ce010d0782835f2e428cd783573d20cc01aca8df09c6fea75f68

  • SHA512

    616514ceb00598241f19da588e9a322f20aa83f479391c7982b33102e3f7f40493a350dd97b324afb97faa2df4474b3d05138414144f3c160d7902ebd0e9a5da

  • SSDEEP

    49152:3S8zVj6nLkXbmQtu1DlvKG/qNXCVMcccCnFguMIyswsMed2:3S85jICF41DlSGSNXCVMeQFgubNtMed

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2