Extracted

• • Target

    0cd18f67b575e8e34f59f5bd4f45b5aaa942b3273f4ba1f21b29801c11a0ff2f

  • Size

    2.3MB

  • MD5

    bc99531ccba4374dfc43de0be67147bc

  • SHA1

    704d8d5ca5138a58a7ec5515ac6a94c1a0c8649d

  • SHA256

    0cd18f67b575e8e34f59f5bd4f45b5aaa942b3273f4ba1f21b29801c11a0ff2f

  • SHA512

    7d2816dab2149a8ffbe19fb29be573e1dd339509392ab1f46f5d166eaa784c4d93d3db38d671273d686835a6a1b347db71b0816b3016893e71c59af08d01efcf

  • SSDEEP

    49152:fOJXmeLARxIJmJCd3npL4Nr/MQaBeyyWDg7GStLyXHxp2vy3iK5:fgXvAG4CRpUNr/MnFg7xAe4is

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2