Extracted

• • Target

    68cfcba954cefe1bae03ee109dda0386d2f897a805c2fff96b539a5443ecd6b4

  • Size

    2.3MB

  • MD5

    2414198f1bfe185780b5549bf67df4e9

  • SHA1

    04237fb0b148bf405a6f5e7681eef3cea471a2a5

  • SHA256

    68cfcba954cefe1bae03ee109dda0386d2f897a805c2fff96b539a5443ecd6b4

  • SHA512

    953cf8fa17235d3f7fc04646693a66774a08f365d2e7fb789c0397abc0d20ce8f1a403e276fd49d69bb1b4fe12422ef52bee316ba1f3a9cb3efaf869e3b85fe1

  • SSDEEP

    49152:HeSe8Q6mkWv93G5iNGv6JvLdkYZN9FiSoIhf0wXpryDSWvh4:xlD23Z92Yj6LIvY54

  Score

  10^/10

  evasionriseprostealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2