Extracted

• • Target

    b47361fe69c171497cd57ca959bb44e89495d2c0946e52d68d520e2593e72d9c

  • Size

    2.3MB

  • MD5

    bfd56792eb5da65768ed925779cdf6d6

  • SHA1

    97fac9489b4a1dcdb088040cffe337b8c908dae1

  • SHA256

    b47361fe69c171497cd57ca959bb44e89495d2c0946e52d68d520e2593e72d9c

  • SHA512

    913993d86998cc81c5799aa86922f5976019871efdd990c69955a6dd016b4ce6898788c5233b72c7b82f2e9fbd3970cc13e0e4c8781c71f87451a0f7205809c2

  • SSDEEP

    49152:sI6UqKOBn/wWFy0hPV1qRed3MIoJwNdyFyxr/gKP56gcliff8cGY:sI6Rn/wWFJEOMIoCNIFyU2wisO

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2