Extracted

• • Target

    19805428363f0e6965f988d48f3294a0c6f645ceb6f5edbee2b094dee919da48

  • Size

    2.3MB

  • MD5

    926eda82b2d97a7af566bae8e1a79e5c

  • SHA1

    15b5cbc0d8a5e29eb711f2e7386b4fe33a27871d

  • SHA256

    19805428363f0e6965f988d48f3294a0c6f645ceb6f5edbee2b094dee919da48

  • SHA512

    8cce482ab643f01e268b3cb550f2a9950b8f3a20fa97f8b5e36cdcfa33683bc85283b43254c965a97f72400245aa6ede2fe0196921066ce37c150a9db1535bf4

  • SSDEEP

    49152:51fKShqc3hpH7S3g3ru/TBsnjV79FJNNj+jk7zl:Ob2H7S32qCnjJ937j+I7z

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2