Extracted

• • Target

    e638bb3b6847c02f7a19ebbfc0f92c2f893b9dff7cb4a8867a7282f36626f6a7

  • Size

    2.3MB

  • MD5

    fbe1e19b44ace48a53280d58c72f467a

  • SHA1

    fecd828a89404345e449686d80ecad9f1d80e491

  • SHA256

    e638bb3b6847c02f7a19ebbfc0f92c2f893b9dff7cb4a8867a7282f36626f6a7

  • SHA512

    0d6927e807de4305fa4f2714bb632e0ed9d2754cf7264f431021859e3430a514626df86a781d07cd86edf35a1dcf0f19ff0df38cb79ff6945c31a4f771adf1d3

  • SSDEEP

    49152:7+aeusaqYD7V+264A+Qo65PB77+3puBR2jkKM3zX:2usaDe+QowP5+3puBJKM

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2