Extracted

• • Target

    03ac7eeae4705dd719ce4f70b9f01e446ec72add7db683923f2b8f72aefd87b8

  • Size

    2.3MB

  • MD5

    fa0d1195771551e814c993bf771aa8af

  • SHA1

    7222f2adb1c759938068e18690d7128b82ef8ddc

  • SHA256

    03ac7eeae4705dd719ce4f70b9f01e446ec72add7db683923f2b8f72aefd87b8

  • SHA512

    52fcda8a83548c3b5072b54c7b8e3d23d80502d805565a057bc915ba001ae241cb43c0573b5511d57312529a58b7e858bab4127724d6afeef100d95bea9bc89b

  • SSDEEP

    49152:XUK0uSl4HSgmKLn9iuPFkMEiNatwy1qXsAhVH56Ky/vrmAqR2Pa/RD:X4ukV0iuYoatxqXsYVH57yKAqR2i/R

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2