Extracted

• • Target

    5f87450ced45e07bfad3f29bc6ef85765624a5fb9dcde56275cc163064c474c5

  • Size

    2.4MB

  • MD5

    75d52c8ee65bfde63853d593533aafbb

  • SHA1

    437bbbb0f5bb6f820155685371bc155847cfa8e8

  • SHA256

    5f87450ced45e07bfad3f29bc6ef85765624a5fb9dcde56275cc163064c474c5

  • SHA512

    dbfb0a3109d75ce83a5f50e8546abfc75caff4b4184f288290af19892511e29dfda10920bc6536a79512d856419cde84b38864f4571e833610bcf2a75d28e157

  • SSDEEP

    49152:yvfBSOC8DeSAdWJAUPLjCM+Mndb0NqDQzIs4CCQtIKPfCYFM:y3BJCwlAUTjBXZDQzIs5CQuuKYW

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2