Extracted

• • Target

    01996df9d80c3049abc5b66eb5a780db3ccab5e858855f0aad9fdf061ec2d0ec

  • Size

    2.3MB

  • MD5

    9b97c9c70a0eaad502598a279943c01a

  • SHA1

    bd73251159d6936e259aae077a0d1c0a735c0dee

  • SHA256

    01996df9d80c3049abc5b66eb5a780db3ccab5e858855f0aad9fdf061ec2d0ec

  • SHA512

    38a160a266fd5161cefcf647360e3ec4e6e674d2ed4499d506c38738851da1baf43d2614ebfd7aaed40d3859ed3cf91f86609ad594c5061ab1f9f2fc3f786a62

  • SSDEEP

    49152:Bu4DSQKmbrwEV0E6Hq1K21mXlcGsQ1MPPCSRKQmNIZKC7RUg7c7aDi:E4DSrmow0Lq1GXlcGssMP/8QmNIZrGAc

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2