Extracted

• • Target

    c69518089492c136eb8bc5902edf56e43978da0d1d71984f5c5baddf029903d4

  • Size

    2.3MB

  • MD5

    130b239595865bfa17bc84bb9689510a

  • SHA1

    b5d4bc923f8f5ba045161e67d206af505f196e63

  • SHA256

    c69518089492c136eb8bc5902edf56e43978da0d1d71984f5c5baddf029903d4

  • SHA512

    b8181d981304e03c510324f93a0783ca6907df6fc3401b6a399ca285c2d4e0a410329b664f29801be43c7eb95dbe6514eea29afd665efb5b1cff5cae7373d50a

  • SSDEEP

    49152:W6Xwh8TwOD5FJ43o3sAmK08REnBl8cXrDGazYa8UhwQXIPFLBWg:W6wEwOlFE3K08REvDlYMmQ4PFLBW

  Score

  10^/10

  evasionriseprostealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2