Extracted

• • Target

    61ecae5aaa27d015bf37634df88f0afbf1be75ea56f2f5ad1eb05257c6462f2d

  • Size

    2.3MB

  • MD5

    3639119a6270933865f7f08ecafacb02

  • SHA1

    cd1ed0c3e942c30e8e3de1f61ea2c1901c0ae251

  • SHA256

    61ecae5aaa27d015bf37634df88f0afbf1be75ea56f2f5ad1eb05257c6462f2d

  • SHA512

    175879f0e1787d944c4ae16b0b5d40a123e5798583539167241eeec91a95e0903386441bce1bda3d4ed6f88fbd8bc120d2437a9855e304cf5ea4da516e5ea533

  • SSDEEP

    49152:lXdxtZhm6NcIKh+0/8SAzZXY2m76bxHsQslPIktvu7PimYmrL:lNxHGIGlt72M5FI7Pi/

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2