Extracted

• • Target

    8032c4045f5f68f4c26bd32674943f6c4b9acd73e2ff6076e577d15e902ba1ec

  • Size

    2.4MB

  • MD5

    454b11aa4a8d2dbd700a0016a6d55fe6

  • SHA1

    74c1e85ba5e80b173b7d05ab967d03a26c2a13ff

  • SHA256

    8032c4045f5f68f4c26bd32674943f6c4b9acd73e2ff6076e577d15e902ba1ec

  • SHA512

    564bb4a91f90880e20d80487b4b4e5fe017d7d8caae9f991b9fce03fc7b6b7154432f6f881090aa6048af4bcc548f6640fcf76c60e7d0b0f44678d35a9d92e2c

  • SSDEEP

    49152:nUTp/YqymaP0OV4Pjol0qhCpQXsIZPOr18kAn3iucfIl2T:cVyrRAEKqAVcI18k4iucMi

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2