Extracted

• • Target

    60d1367922788d117b3459d2ab47e475cf3a11d2915d5c55ba77d94441850c36

  • Size

    2.3MB

  • MD5

    af4250130e8a05ad574c0f6b3dbb0058

  • SHA1

    b743a36eb0ad1abdee06c473bd2eaa45e8477a77

  • SHA256

    60d1367922788d117b3459d2ab47e475cf3a11d2915d5c55ba77d94441850c36

  • SHA512

    ce16179224da9010bbcd76e57d59fa5533dbfbb73ba5927a1c81755b57edc59e7017d1cc9c0f1d1e22956bcd973161432d0748119ff46c5ff908b40827cc86b4

  • SSDEEP

    49152:UHnd8+LPEmDsgRgwp9sNeAXnvAbMrJ3o5kl+Dz4RbpQrZu+cIHR:UHnWYPwEgwcNeAXnvAbMrJ2kEDUF7oH

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2