Extracted

• • Target

    f23ac34601f07e66a9bf98dd729cd5138d2af1f4c5843ec1d420263e5d5d05f5

  • Size

    2.3MB

  • MD5

    6d6529685012b1125bf3b1b577534adc

  • SHA1

    bfa3a9938d079f404ab1ac66d8e5b7e2ab985b5f

  • SHA256

    f23ac34601f07e66a9bf98dd729cd5138d2af1f4c5843ec1d420263e5d5d05f5

  • SHA512

    67dfdf2282040f9187e5ba762ef8072545bac8c102a9528b012822f2caa70b20cafe77b368f40c3cd2f216dc1e4255384d8b44196102c259799192824c35a5cf

  • SSDEEP

    49152:m/mt0pgKt6z4kMkd2HBBwrcBU9lF33/7RxKHO1zOi0aCYF:Jt6kvPjF3P7Rx8Wzqc

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2