Extracted

• • Target

    c247525dc4be5e4a2e2917f606083ca702e19c5315481a6c99e9cc7703473cf7

  • Size

    2.3MB

  • MD5

    57281d4eac486e9606807825b1afb120

  • SHA1

    61e899574e160eec949dfa0630dee2befad09722

  • SHA256

    c247525dc4be5e4a2e2917f606083ca702e19c5315481a6c99e9cc7703473cf7

  • SHA512

    4d81931f079268d7cd43bcc340b1c76b765be371f084ab3e5d99bd63a484ebc310a90ea0929510af33b5d8c6f7a0779a9c8f538bbf3e479e5f09fb8d87dd9440

  • SSDEEP

    49152:g0wjPR8wZnX9VAeCoR3LepQvft0EBpoPttZ9Z4jDOEBFlXT6:gjP5tV3v3LeEb6ttTZ4HFBX

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2