Extracted

• • Target

    9abe53201332020477780d447e698367bf97120b72a83e71bb7731706586a058

  • Size

    2.3MB

  • MD5

    237048667c00184b70768fbc24bceaab

  • SHA1

    abc034d383c741533127b1af676bb5d5a013898b

  • SHA256

    9abe53201332020477780d447e698367bf97120b72a83e71bb7731706586a058

  • SHA512

    bba0a1e7e4e7fafc7bf163aa78ff1090aee27301e61c2b2b3b987fa45f849330f0c5aba969377b59bffede0dbcf4f5d5c008758a15a76683e98cfac21462dab0

  • SSDEEP

    49152:t+r1SO66EyMY1MU/wS5O2RZM8To/J4qelVXU:tv6RIYrO2Ri8GJ4fl

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2