Extracted

• • Target

    5e5fea23246f2163e2fbe29ed68d57a5b99763f298658e6d14e2c8bd6b72fd0f

  • Size

    2.4MB

  • MD5

    6b85636befa5cb33fd92e2af64616d4d

  • SHA1

    44b4780a6a037bc7f420aa2d1e69e29721c33e2d

  • SHA256

    5e5fea23246f2163e2fbe29ed68d57a5b99763f298658e6d14e2c8bd6b72fd0f

  • SHA512

    38db3f9dd9049f4e334d11d191f5e78b480c8340c9630db937987fc9beca466c5ddf01e4346e08585964abbfef8aaf7840740613b8666ecad393d45d27a072c6

  • SSDEEP

    49152:Q6xnxhgrkYrNaLpPAjJkLmET7iBSrh8eLeJuJBB76ctSU:Q6P49aukqi7jfeJuJBB7RS

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2