Extracted

• • Target

    b88cb8d3ea91859b73d8e9af00272dbe363872c6476092150594fa3bd9288059

  • Size

    2.3MB

  • MD5

    0c30c4671167746845e9e3aa84b3f89b

  • SHA1

    b5bad96b42ced22e29e960fcd649a8b99d167d26

  • SHA256

    b88cb8d3ea91859b73d8e9af00272dbe363872c6476092150594fa3bd9288059

  • SHA512

    4b51d545f7e82af814c5a8b283df8b7432fa8a46a38fa86195029ab101b77661c9ab055e33caa7532756a4bebab4dad7b0881318166cc68773f3e21c0446360e

  • SSDEEP

    49152:/l5lugyl26OIky1LFEIIzEBtyKIimADVBsSr3WQFD:/l5lFI7UIIzEBtyDAgSfd

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2