Extracted

• • Target

    446377c14ac4a733b4a66913c2c9fb3bfee8123dfd4ca7371201b6e745a9a6da

  • Size

    2.3MB

  • MD5

    f7d4f4eeb8f1ae5998cab46b01bb6ace

  • SHA1

    e0179797f27e709c6beda0d54ea099810de84b47

  • SHA256

    446377c14ac4a733b4a66913c2c9fb3bfee8123dfd4ca7371201b6e745a9a6da

  • SHA512

    cfc1d1e0e5768d0825808db586eba60c3ad5ee0ba4c391d44f16105af461b9ccba594c048a9573873d01ccf370b960b203042f58884b11bc1a340f6d265dbf74

  • SSDEEP

    49152:q1ZJznePLeapGRf9F0WvMHDVc8++X6zjmxr/SDxd6VPE3mZK2:eZJI62GRf9F0WvNPnziRqVmJ

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2