Extracted

• • Target

    9b6d33fffabd69f494586d5082315acb967cc4f39d39a9fd83c13ddcf7f2728e

  • Size

    2.3MB

  • MD5

    bc1626d0ce3ec13f3a762c85de00c160

  • SHA1

    5e1abeffc1f1d1ec718653f75f285969cef24ff0

  • SHA256

    9b6d33fffabd69f494586d5082315acb967cc4f39d39a9fd83c13ddcf7f2728e

  • SHA512

    8c9c53a3efdca297e86d1f538b6c53900a7d9b08be5bf29de2951b0796c6ff580f13d3710be8339e20ed62f68aa2b65032ebbb612b37c6464f01113fb3478bc5

  • SSDEEP

    49152:2z/Bn1n4A8go9YmqGZjmahahF38QkesaXikiaSMX9sbk:2zF17zgNmrBlk6Xi+VsA

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2