Extracted

• • Target

    c69777bccc08359225dcfebe4621ced44f56ebe0c6fabb68762b5b85c778c351

  • Size

    2.3MB

  • MD5

    449b04f39078c460f90b496facfa9c29

  • SHA1

    5cf88a7a008639dc6d2b61e315afcc5fd5f38fe4

  • SHA256

    c69777bccc08359225dcfebe4621ced44f56ebe0c6fabb68762b5b85c778c351

  • SHA512

    5ebf20f10bbe7a30a7ab7c501b1321a963138d1a05c59010b5839da537f028353fb4391d5588b9684b8ef237d7c7d5cc3b0e9738df1cd02e4090ef901f432e11

  • SSDEEP

    49152:YQ0WHFzjFmlyxsz9iAZ1iDsDBtB/dliBYQ3AUA82a0VUS9:YQzZFM4g9PtlJQ3Ay0VU4

  Score

  10^/10

  evasionriseprostealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2