Extracted

• • Target

    05e5cbf3a6e9cce11a526f27c67a45ec474e0238501f0db56bb51b66280f75c5

  • Size

    2.3MB

  • MD5

    d0db3d33c1868fb105629ee3badb38c9

  • SHA1

    4dad17472e1af064b0a5d9a451675c2cac89c71e

  • SHA256

    05e5cbf3a6e9cce11a526f27c67a45ec474e0238501f0db56bb51b66280f75c5

  • SHA512

    af37f2230c2c95e2694b74c969b752d9d744eb558cfbb53f73977616dce23923d8f7e1897be6005741445f689048a759495f34f75e42ef03a2e992291cc69582

  • SSDEEP

    49152:PMM3Clk3y0KDxai2ylX3LdSLS5dfCpQpzhuBnQ7SwM87c/xRKYv8:PIk3yjHQO5dfUohP7SF87AxwY

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2