Extracted

• • Target

    50a4437dcc574bd220897047ceb38093ece9d14366a756b2459e9cec03b7a5f5

  • Size

    2.3MB

  • MD5

    0bb9d76dc12b61a6b2d57bd6993c75c5

  • SHA1

    02d6660bbe5ddb9689a6c4f3642525ec19ff7743

  • SHA256

    50a4437dcc574bd220897047ceb38093ece9d14366a756b2459e9cec03b7a5f5

  • SHA512

    72665cf6bc7e683025bb6d09f155a19a99c7ce6f82ad5caf104d0524d467d07f2ffcf3b311eda0a654343cccb83eb6261272ea5c8946afe70a39dfa37d8872fc

  • SSDEEP

    49152:fLteq4y8egGzaK7P3Zm9ITUHRed9L0YZ8Qe80nWmntDyCm+IMXgE:fPfa+mIEK0i48gn1/mC

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2