Extracted

• • Target

    f14c2279be7e68a3c9ad52c2c61a1d084c4c50b6c75c5bf9d579f95def8c02fd

  • Size

    2.3MB

  • MD5

    6717497253690a2448dc4a0e61aaae87

  • SHA1

    a38681367e163d732934223dcf8d7288db1fde65

  • SHA256

    f14c2279be7e68a3c9ad52c2c61a1d084c4c50b6c75c5bf9d579f95def8c02fd

  • SHA512

    a8448086cf360541bdd1675f4e02b4303ff770b19ca55b77966ae3c470117daa91a769d08121b7d0c54f8670ab11f4c92bcfa038d50c78f240e1f47be45f5f78

  • SSDEEP

    49152:bC9jhKOsaMf5wZJ2jLnnHnMziX4k2axX91cMSlcSn:bCSOsZf58YfnHnM+9xBnc1eS

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2