Extracted

• • Target

    f15a7527d99c568fb570ca5f5a2276d453321de7dbbb0b295b4afd8b98fbf72e

  • Size

    2.3MB

  • MD5

    de86232d8850220f2707d2b4c85ea331

  • SHA1

    6386c3318e3b52bc5e9b2c72e0ab235a7ef11118

  • SHA256

    f15a7527d99c568fb570ca5f5a2276d453321de7dbbb0b295b4afd8b98fbf72e

  • SHA512

    c9614d1df97c6c7dba6caf91742d0b08392249c622048f386ce8531cdb170c2a10cca498c2ba4e17929ec34b03b7ac03046128cc99c1125695c546cffac549b0

  • SSDEEP

    49152:Vtx8jvZVFOVc47zBrJ1TfMw21NLFXKrMs5Sv0LXK4:7EV2P9EdNLFXK55Sv0La

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2