Extracted

• • Target

    a4080ca9e425581147cfa17d97e55011325594322515550161a59a04ad569839

  • Size

    2.3MB

  • MD5

    b3fd158997feaa3d37d6e00994d16c3a

  • SHA1

    b93bb77f2afd2a83075aa8e3be5688dd81d71b89

  • SHA256

    a4080ca9e425581147cfa17d97e55011325594322515550161a59a04ad569839

  • SHA512

    00296bf4debc0f55a7f6f4d9d17326142e077a1844d80dc1c1ed935ca7e6bd09e9ff0be195abd148ab6775a7d25a1293b23632b9b0d9d3391b247bebf4f4d4c0

  • SSDEEP

    49152:L1H5+8F0tSq2XMjfM+ne5Kl+m69y+LcslwRlvN3TLqIvQJaPpUVFeqUL0IW:pH5+JtUcwFi69yVz9TuIvVPpuonW

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2