Extracted

• • Target

    9e55e8a1d6a9d5908e3cdffcc446d8c0ecfeebc26a8eae536b88510f1d5a351a

  • Size

    2.3MB

  • MD5

    4f358b095b3b837bbfea08e15b2102cb

  • SHA1

    0f496c6923968c89ca511941f1f47c72a1b63877

  • SHA256

    9e55e8a1d6a9d5908e3cdffcc446d8c0ecfeebc26a8eae536b88510f1d5a351a

  • SHA512

    e61a500078523a93e34ba837b221777ec7b9950954a32372d498b829120e90bbbd399e18187827ed5718333dcdaaef1c3e41cdd850ef5136af5f1c7299a3e441

  • SSDEEP

    49152:lKhp7kw9JvqftVniy+9BiJOWrYS3Q3MDaQv3qiCQ:ljwDqffg9BiJzYS3iuaBiCQ

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2