Extracted

• • Target

    94284c6c824e373fbdcfe0b241e80c2daf11b863cc3af286f194f868dfbc080f

  • Size

    2.3MB

  • MD5

    f4444addd56481108fc871aa14adf9ec

  • SHA1

    95e9fe62695c7f9ad3d1ba5e3b044175809bc26a

  • SHA256

    94284c6c824e373fbdcfe0b241e80c2daf11b863cc3af286f194f868dfbc080f

  • SHA512

    a600e4b11bf2cf674bb2d1ef6055477486c549cd4e94ef3609de43cde0c8cb4b29a97b5955c00c3f6a3ad7f5c68fd15dea2b05c8c6d72246ab22b50fe446c028

  • SSDEEP

    49152:i1NUJk5rmBmtSSYLd2JcBSlF6V0Jxy1gbGPLh8/BL8Pgbm3qMyXrC:aSWVm8tSSYZZBS/+0OgbG18iP6H1rC

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2