Extracted

• • Target

    8e95aa6a62dc32cde5f0d52834f36a987494158e7e6e46e94299654e8f4cd197

  • Size

    2.3MB

  • MD5

    c14513edb718a64d50f867ae0d1aa428

  • SHA1

    bd80d5c7bfa119118ad0a2f9654867154aaeae46

  • SHA256

    8e95aa6a62dc32cde5f0d52834f36a987494158e7e6e46e94299654e8f4cd197

  • SHA512

    e55c6a8e37ab9395bb10aab42860e497b9bf54c05fa98fecf540149df3f8ad394ff6df617be09d1c444c293bc2fe12f805f207d6afbff5ce2d469fd4c7e6775b

  • SSDEEP

    49152:G2CH79nSR6hhGeVzpHy6Nd9ZwLanL7SZxot4h6O8TLi5IkVgP:G2CZnb7VpX79Z76ZxI4h674l

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2