Extracted

• • Target

    604dc69ca46e014050c8003eec1e7e40d9104ae9bfd55a9fb1b52f1070ccaf9a

  • Size

    2.3MB

  • MD5

    134c526dc140efc87f895021553f3441

  • SHA1

    513a8ddc3f9e7f3e97af5939ecb75330fc263e82

  • SHA256

    604dc69ca46e014050c8003eec1e7e40d9104ae9bfd55a9fb1b52f1070ccaf9a

  • SHA512

    4b1bf437739f464cd4b6fa565db6d0d26ee50eea022a38a417a6a2969cb1b9662f3f3ad160e312ae85c838ea35d13f4f1210a69c85052e62fa46a432fe6f7500

  • SSDEEP

    49152:G6raSB7eUdkVO859ygqmx5raljFlaSOa9IHAd0WgSKCsedI:G62SsDV9ygZPSgwfSLe

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2