Extracted

• • Target

    a8608b904715a0b0d337c005061ae4ba50150255cbbcf28a25a0800de3ba72e3

  • Size

    2.3MB

  • MD5

    d98685657a7a28b347cd4240ce3e1ad6

  • SHA1

    ce2c4ae80666f6b3952674d0a12e5493f4dd48b3

  • SHA256

    a8608b904715a0b0d337c005061ae4ba50150255cbbcf28a25a0800de3ba72e3

  • SHA512

    92713d50257db122e5932426874d0d193e9d1757788606d72013a6db888dbc5b3567f8b734dd869bf3e95a0fda4211f1137afa9e9db2859ecc0e18707b88ecd0

  • SSDEEP

    49152:p2FX/1SrP2ltBKZr8Hch8YWEPdAlCOWNN4+TltqebA6j2JqYmKDuHAb:MFX/11j4ocDWkaxkJbA02J1mKDp

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2