Extracted

• • Target

    1216092ef2eb6103f514f6746eadd8414a66590c846ee25fe322e55561ec09cc

  • Size

    2.3MB

  • MD5

    64495517db36562ed1416fb13b790a5c

  • SHA1

    6bc07dc3db7ee58ae616e7462705a54c0c6ea0e4

  • SHA256

    1216092ef2eb6103f514f6746eadd8414a66590c846ee25fe322e55561ec09cc

  • SHA512

    a0e91bca52e35ba89ebf57ddd6917c3a2332d44f12cb6c8e255725026a5e12210022701a773c4b1bb9d0116bc4b653818734c6e5209eca75e380810f35001907

  • SSDEEP

    49152:uXWpCw+quX3ssGcO7ONa44dEf+zJF2MUiHbgm2j:TCECHGcN4Of+z2MUi2j

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2