Extracted

• • Target

    8db28ae04a8e6f3daeb956527165369c3411fcede7a2eefb686754203a53becd

  • Size

    2.3MB

  • MD5

    045525cf53d5d0ca74784e9a5d51066a

  • SHA1

    a20672e35bc028d18f44d2b0b5cba753c55a2143

  • SHA256

    8db28ae04a8e6f3daeb956527165369c3411fcede7a2eefb686754203a53becd

  • SHA512

    244a5816ea0aab7d49e93f0f3721466fdae565bedd3dd6a2bf06059e665cb1206fe9226b030ccb365e0801dd6624b9167ced91e894f9136785a4fca54414d1c1

  • SSDEEP

    49152:aO/40xUEZTw/RJoKw+60YmhSbqPMjSEp0CB5A9ps:aWNvZTwHrw+uzmMWNCB5G

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2