Extracted

• • Target

    87b128f0266a64e1aec966b3daea5ea180920960a35313e6bc4538a6d8b9e191

  • Size

    2.3MB

  • MD5

    896239efa1356ca2abff090e7b22df71

  • SHA1

    9e630702beeae53e2f8f9fcaff62e9bdd6d2c1fb

  • SHA256

    87b128f0266a64e1aec966b3daea5ea180920960a35313e6bc4538a6d8b9e191

  • SHA512

    e6a1f0bd7db41d61543687b8e556a7a4cc97c9bc65d1564823b5ec556712824ca46e6b755149632908bebd732ec303d7514327c1281161348939a0a3a76dc923

  • SSDEEP

    49152:bEaB7D2nucZsQQQtVT3NB/5kfjpmYi+I8Z1C5zs:bAZy83NB2rp++nHso

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2