Extracted

• • Target

    740fa213c3d59c6f0d33a0020a901d1fd9e50f6746438ad02b2d8c66b083c739

  • Size

    2.4MB

  • MD5

    bdc88ebff2c97c43a231763acc85fce5

  • SHA1

    773969dbc2a235a04dfdf951b56d86a98d629409

  • SHA256

    740fa213c3d59c6f0d33a0020a901d1fd9e50f6746438ad02b2d8c66b083c739

  • SHA512

    a1344b83a3620ffc42382ea47199a96c97e0589b2d3791517f593bbc6c25b452954a88a32521e8244ffa57e49c4aeb174963db4f1c6fa6a19f88b0a461dd056e

  • SSDEEP

    49152:9wy+d9MVjbDp8HBGotZM0E9Df3yTi+aM7EIfKQeKVSc:y2VvDpQkGZdE9DvOKMqKV

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2