Extracted

• • Target

    739677912a203298e895ebbb710ff93d53beb16bae22e049dd1090a4aaef4064

  • Size

    2.3MB

  • MD5

    3ad5a60a97ad4e5181c5682c77a967b5

  • SHA1

    c32f82d0d5351a5c608d57a57128d8223b2c31d2

  • SHA256

    739677912a203298e895ebbb710ff93d53beb16bae22e049dd1090a4aaef4064

  • SHA512

    802fa821ecae09ca64da88dfab3fc9d132e2877ff20c12f9f2726c861b244355d99318f7f91fd3378bce2095b89a145c0a9e8829a78b337e10e38909a17184e9

  • SSDEEP

    49152:kGBSOlU5A1V2PVztnTqpVNqK3kPZZlAMS1u:kablN1o9ztTgVQK3kL

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2