Extracted

• • Target

    b9a9712dd09b68614a8cbac0a43358afda5656ee3d7cfd770abd76cbae51bcab

  • Size

    2.4MB

  • MD5

    1fb2fc8cd4a53c33840cb6088bcb525c

  • SHA1

    731adced6db4f553d95afe35314aee582344ec26

  • SHA256

    b9a9712dd09b68614a8cbac0a43358afda5656ee3d7cfd770abd76cbae51bcab

  • SHA512

    54acd85ec2976b50b6297240dc0493fd695ef0d765914599c939324a0a828a6717c7a2f9b085e7c666b2a5609fa15acf30b0b2391d38764ce6a922a71e621e5c

  • SSDEEP

    49152:SurO/qB2Yh1Ihki79TDNQrUcScJ/6jDgLmEC+8sq+hudL/Kk+:SF+h1QknrlZR6PgKEC+8sqiuh+

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2