Extracted

• • Target

    2923a0bf5dfc5ca71d6d09fc66c9a90bf3605306148772d7d9bc02abe90acdf1

  • Size

    2.4MB

  • MD5

    461f7b94755dcb5b731d335684ee59b0

  • SHA1

    b1f23228c40ca71c2c82025bb05908ca80e51f77

  • SHA256

    2923a0bf5dfc5ca71d6d09fc66c9a90bf3605306148772d7d9bc02abe90acdf1

  • SHA512

    8db553e1b7bb07de1321cd1c0d0ad9933b35348b9539668e4fa6e66672d12816beb5eada1a0c8d9298aeed0d39b0be0ab89721c6e8299e71fa81d3eb8284d32a

  • SSDEEP

    49152:YWfMDgCEDNCJmEGgQmkfYI4DfxGVjsHTCrZeuh7rw7wHosWw9Mlzm:VLCTkQBjWuOdeuK0HosWw9c

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2