Extracted

• • Target

    4bab96a32eb8d7cce018877a4d321c606e33f62311c199e399293f167fe2ae7a

  • Size

    2.3MB

  • MD5

    b3c59d6d071d6cfd9f9ca3900514afdc

  • SHA1

    d834fc459dfd27bfb6964fad32e9a5a0a54efa76

  • SHA256

    4bab96a32eb8d7cce018877a4d321c606e33f62311c199e399293f167fe2ae7a

  • SHA512

    fd3cdf603acb2d1046b3d41ebf47eb27a6144d29a8a558738043278cecd45453b30f564e76c9d31bf5cfd56cf4ea2c89110cb7726224d2a3bca199eebc09a8c6

  • SSDEEP

    49152:/NF7TlT8RoOF7fTu2YN31uTVTQtTp1liKAwcCBFweBCaWDXw9gGmGI:FdqvhfTun31KTQ5ivsvWbwOGm

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2