Extracted

• • Target

    7a7bcea7725b36986e2852977b0d3cc887cc01e5214119ac96fa24c34f587882

  • Size

    2.4MB

  • MD5

    394a3810309378bf7ee08e9165fd0908

  • SHA1

    5be060b7f2c5c0139641646d8423eb5f19097785

  • SHA256

    7a7bcea7725b36986e2852977b0d3cc887cc01e5214119ac96fa24c34f587882

  • SHA512

    3bb2ef6b827a0dd10a811ff80444ea3b008a170c8b70679f94363acda32c997fd40b12c2b0b6f45bacba3069e48db1694b9a24fd248f3e167c97eef28e2e86ef

  • SSDEEP

    49152:VvfdO8a7DKymbiJ+Ld1G50UbXqZWNY9CCfljJxH6++:hkpDjmrA02NYpm+

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2