Extracted

• • Target

    093ae1c70eec1b50a251b64fcdb3d9fd05a24cde2ffa8fc1e5ee6d9c0d34681b

  • Size

    2.3MB

  • MD5

    dfaced4d29e3f84f748cba5120619185

  • SHA1

    bfb644ebc5e3f0673a7d1632780a6e2e77a63f71

  • SHA256

    093ae1c70eec1b50a251b64fcdb3d9fd05a24cde2ffa8fc1e5ee6d9c0d34681b

  • SHA512

    54468e831a6e255a3952e8e75f98d8cd1af6f3cb1ed2a3f19e92f64ca8b762133d102f625451260c55424e8dddb191cedddcea2a5388b198a8d44d7396eb8586

  • SSDEEP

    49152:2zCvxBVmsxSaqJeHUPNZKAbREZYPamT6AYa9qwvt1qICn670b:2MjV78aqiUlPbCZwPT6Pa9qwlcOQb

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2