Extracted

• • Target

    8c45d6a3390ce1619466ca6a5f8abf0ffd6a9476ce3f209bd6c3e6d3826c3d1e

  • Size

    2.3MB

  • MD5

    59ca969045fb6c14e2a0fa5ef0a8cf62

  • SHA1

    713fda74f9bcc6bce9c61606a6a88d1cb8984026

  • SHA256

    8c45d6a3390ce1619466ca6a5f8abf0ffd6a9476ce3f209bd6c3e6d3826c3d1e

  • SHA512

    7da4f1da191599ac9c11588dd934cf16690d98fc063fe8e9c096b56d92daf5e41ae8cece8f7f993755ac453b871220e32e64567d61a262b7db8ba826e446d6c7

  • SSDEEP

    49152:jIgzNUwaowbr6dsHq5gmD6wPev2+NdK2XST1R/1ZfNVjjtCFsF6:jIgBUnnbKZD6wPUST1RNVjB2sF6

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2