Extracted

• • Target

    f36be2f326138c49d5031a6933df70514ba539a1e3045ba3f107a8d5e88955fc

  • Size

    2.3MB

  • MD5

    07287712a20ddea769fd7e3637c57c78

  • SHA1

    e0872529d2d31eff0f9a7bf86701a2366809bea9

  • SHA256

    f36be2f326138c49d5031a6933df70514ba539a1e3045ba3f107a8d5e88955fc

  • SHA512

    dd1d4e78db54cefa64da9815358bb9eb9cfe2af4616443ec81493d6d8298e79d19196cfe9ecd607fb067cd4d4cb3ad7589f2ff63beefd34e27c73ed3d736ebc7

  • SSDEEP

    49152:PSYTsSL0ODk+95/mISDZB1STWcAmE/6jLs59XVB3PRVV:PwSrTj+992TWc4/6jLi9Xn

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2