Extracted

• • Target

    3e0c15a47369ac140ef39bbe4425cf38eefd7090a47a3d7f9161ff57de779d3b

  • Size

    2.3MB

  • MD5

    92682eba9acd28275995d653f885cc8e

  • SHA1

    ac1992f8e63524130a4514afbc8c310319974521

  • SHA256

    3e0c15a47369ac140ef39bbe4425cf38eefd7090a47a3d7f9161ff57de779d3b

  • SHA512

    5bed2bd3b9980cb01d5f1d772e3fc4388fc509a2c6907a781b3ad847a2c2454e4078b82548c7bd2817f887b15eab522fca06c694485b46b2a3f2dce58b08c3e6

  • SSDEEP

    49152:x5kyljKjNWUAY7MG4BwOi8tDpBazEuP2cyLv3OBD8U:MyZsbLo1pBazENeBIU

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2