Extracted

• • Target

    4b4afdec871733b2bc12e97eb8ed9d34572af0438881388a45a5f5b471446a53

  • Size

    2.3MB

  • MD5

    2085ffd70bf58ead3eed83308f7bfcea

  • SHA1

    66fc8ae9eec9272f5b6ee1275126c98d8b798db9

  • SHA256

    4b4afdec871733b2bc12e97eb8ed9d34572af0438881388a45a5f5b471446a53

  • SHA512

    556da310128c38f21462aafca9dc79aa4598f7d4dce2771bdde1e5e4be599108b6427f68c8780d38a4cb8d1abd2d9656e7a67b4db608b238f98ca149fdd99470

  • SSDEEP

    49152:WCXfmrSptkOvVrjW/pGEI1pjitP/mK/tYVYCJ7zWdn4S:BPmrW2OvV4pGDkVEY6G4S

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2