Extracted

• • Target

    4c14ae831167ea856ebb9ed9889d60ce32732621e4064d836145a201d51c05f3

  • Size

    2.3MB

  • MD5

    568caacf39940f44c5521d8fca4ec913

  • SHA1

    fd7607fa77f60f376de22ec431b90d23d5ac5a1d

  • SHA256

    4c14ae831167ea856ebb9ed9889d60ce32732621e4064d836145a201d51c05f3

  • SHA512

    43a22f7f3e8905e2cb7c924ca81e5ba9c1f8a9d28874e7d2c28b21ea324cb7ff44008e8265a23e17de82dd0d6ef1cdbb194c2de3fb7406fd67f29d5c70bdde77

  • SSDEEP

    49152:YMtRjq93mTSgteQQSiflEwUdtAC6T3iAvMEYCywkslBMpM:Y0RTWSifhMAC+3fUZCydsoM

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2