Extracted

• • Target

    4e559ba8fdabeee733bc6784f225488fe4b8cb75c7248742181d2855e984b6cf

  • Size

    2.3MB

  • MD5

    b3d82d10976a1b742e726196db569156

  • SHA1

    bce6bb1ad2f742627012740ff7101187dd8d9c3f

  • SHA256

    4e559ba8fdabeee733bc6784f225488fe4b8cb75c7248742181d2855e984b6cf

  • SHA512

    ab4961f58ab075c42c72bab495be579a02385423c777be1912071f2f5edacd30b116883069217c1254c60262427a27bc0c5cdcc05c51b31ebf202e4af1120126

  • SSDEEP

    49152:nQAqHkY/i3BCnMrx1Nd7XxxwhZunBzEjprI3/p5cH4:nF2H65x/mhvprI3/ph

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2