Extracted

• • Target

    0daab7269d61dd8ce046825b64b0549afb28d2814119dc0542647a210839dd44

  • Size

    2.3MB

  • MD5

    5655efba6d00d3e48a62ae2258ace141

  • SHA1

    ab5877e301faf405ac3214337e160de72eb968b6

  • SHA256

    0daab7269d61dd8ce046825b64b0549afb28d2814119dc0542647a210839dd44

  • SHA512

    bb65c0af908d3e3279428ead4b86718494131367b2d8da2403006c4242db96fd6cfb44f32bd7012bf00d675146836df1e70bdfd82e8f57fcc7a02ff2a6b16ee1

  • SSDEEP

    49152:8TwxIP9tzf9qtL1MrRC8Cgmc5QoY7Z9AHMSwp:8kxIP9tzViLmr7f2AFwp

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2