Extracted

• • Target

    cc95b695d76521b40483f461b78a4fdf56466e6b0ec0d0a949e8d19c01a43f24

  • Size

    2.3MB

  • MD5

    286667349c40c1c3e83fb8c2d185eb44

  • SHA1

    1c7f756002f58f69f20c4d830891939c49f24f9b

  • SHA256

    cc95b695d76521b40483f461b78a4fdf56466e6b0ec0d0a949e8d19c01a43f24

  • SHA512

    941ca948195de1fa5b85b7ebe206fe7a6871a617dcad6b5790294d2b777c8fc35161216d4eb0de45e69c2d821a6cf0608fbeef4ff674504eb6ca40cef92fb9b5

  • SSDEEP

    49152:/hRe9fSZdEabzo9DGIATYoeWci1ifDN2sAcz6K1:/uqZdEUIgYFWv1ioy

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2