Extracted

• • Target

    1e7a8c11c988412f44805b3b7f7c560352b6aed04305912beef9d458a2ecd3ff

  • Size

    2.3MB

  • MD5

    5deeae1200cb6f919d3599e9b60115a5

  • SHA1

    443bdeadb0556d10660eee580cb01512698240d6

  • SHA256

    1e7a8c11c988412f44805b3b7f7c560352b6aed04305912beef9d458a2ecd3ff

  • SHA512

    d8e259f3c4e5b85c1cf1d7abb3abb960b521a45b40936323a015908b957e13d03b750b25e6646d320dd75f4d0e420e852c92aae1cc6a02abeb342b5f67281a16

  • SSDEEP

    49152:fc0ubFjEuv3p/Ya9KY6LaRvAD2Tanag/A9n9xEyvjifGRdIAlNKInI13a9:fPubFjEw3p/wY6LEvALR/A9n9Wyb3b5Z

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2