Extracted

• • Target

    d8fe9b68fd5a35e2b8d45fdea730a8e5e0b507fa54a87615af66417f6eb4c0f6

  • Size

    2.4MB

  • MD5

    00072d93d706be1f20656d1fda4850a2

  • SHA1

    0dbe64da685cb764db425b111a6286fbc26d0e5f

  • SHA256

    d8fe9b68fd5a35e2b8d45fdea730a8e5e0b507fa54a87615af66417f6eb4c0f6

  • SHA512

    c975fae999b52c3adc9222ed7799958235e87584c1a8c4f68d551b5a7df68addf607456956e771d90d68010819db327870d96ea4fcf3a178be74464738c7b4a6

  • SSDEEP

    49152:AOtMW3Qpx/be2++sUwdp+pH6FJZ5tD9VkXDCT4GLTzatuxiECObt:AOtMeQjje2++slpo6FJZ5vVmtGLCturp

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2