Extracted

• • Target

    9f818ad13b0fa0d28c61ac2a8d48eeda92663220b04235f4079c1b8a8fd57581

  • Size

    2.3MB

  • MD5

    08dc356808787c2b15044060e140fdb7

  • SHA1

    0b35ca3dc1bacebc5040b01d85ec834590da95f4

  • SHA256

    9f818ad13b0fa0d28c61ac2a8d48eeda92663220b04235f4079c1b8a8fd57581

  • SHA512

    abfeb10c129c824b6cf3cc837d6ed26ce0fa1275e7a32e59f0cab658cf7cef8e9e9d3b8c082cf8674f7bec455231dc4b843c6ffb7d4d7873fb65c84954ca02b3

  • SSDEEP

    49152:65tpl8GnBf4gw+BTmhmvLwT1uUU7iO7Yh3mTAZ0Z5FevfTle2:6v8GBf4gw+5KckTAUU7722kZ+5Fevf

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2