Extracted

• • Target

    d3d0eeab1a06460ed303b065248db53d47bfd5c253324b0d2f9efcc2dc700a47.exe

  • Size

    2.3MB

  • MD5

    9437d6cf2745f8683c3aa908e01b03cf

  • SHA1

    4b954d00882c8249d11b61440976b2993ae4738a

  • SHA256

    d3d0eeab1a06460ed303b065248db53d47bfd5c253324b0d2f9efcc2dc700a47

  • SHA512

    8f8ef99107b126d82d5545ed8108fd1ecb6c3b743134766a1c213ee0667cadd1f0f0add0a3f2b111d990e45cd2a10480eb2dd44276cc4956f3dbaa5ea46f2f8e

  • SSDEEP

    49152:jtkCJbOK+TKeNUXXO08QNPXzhVJGcF6V5sN7sqlvI:hkaOz32XxNPXzwcF8uN7sS

  Score

  10^/10

  riseproevasionpersistencestealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2