Extracted

• • Target

    a513535772abdd51c85975a50aebe17c0e6557ff552f969324eaa7859a84d03a

  • Size

    2.3MB

  • MD5

    6e9d5a1594638480b93db2644fe2bf41

  • SHA1

    1aca8188cfdf58fc651341a1110f67aaefe1b825

  • SHA256

    a513535772abdd51c85975a50aebe17c0e6557ff552f969324eaa7859a84d03a

  • SHA512

    52accdf3556339b4bd7fc999a6b3334fdff75b0b5156ac45bd3cb94ae2e0c08cd3adabc48844be865047276e5ab0f609e89828168697a4cefeaf05b0d496dfb6

  • SSDEEP

    49152:O7aoegNQ2A5SYcWMAMsuxN6Z2IOk8GoGXKRYwwgzixV:z1iQ2I3xLzO7rUCZWf

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2