Extracted

• • Target

    aa6c1a1a2d25459e736cd4121b7418d40b9235c8ef7386e5129b1d6918185ae7

  • Size

    2.3MB

  • MD5

    7df8e58107cd792433c4f06618461ad9

  • SHA1

    379cbc1af2bd2f048b8f59fcc42f9bd06040ed0d

  • SHA256

    aa6c1a1a2d25459e736cd4121b7418d40b9235c8ef7386e5129b1d6918185ae7

  • SHA512

    50c68057762674c06f6f13379fe786615c0e68e57f74e45497be0238dac269fdf3de9d325f74517f3aab861bdf612234eba25852c1df35da4ac4afa23100a0ba

  • SSDEEP

    49152:rtoxB0+H9b9EhLyubmRedT+j/7TdXzQS/pDCFZCF5uBlLXlUQ28QQ:ZovHWheubDT+rfZzQS/pGFkIr28Q

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2