Extracted

• • Target

    81364f1ba90c0e9fa5691015aecb286239f0f86dcface34ea76520d127d32166

  • Size

    2.3MB

  • MD5

    5202090c5f53c126f72309786c2ff3e5

  • SHA1

    3bcfbf2ff17cb515baad37ee286abe2cd9a7b2a0

  • SHA256

    81364f1ba90c0e9fa5691015aecb286239f0f86dcface34ea76520d127d32166

  • SHA512

    a8d0e3feb48bae75a787d9f7062d34d71dcd78f91d87486cd9675b945898bedda93f259877b105f78eab845506d153b85ef9ca496651052fdda583856f37f593

  • SSDEEP

    49152:PBjADtZoBdNdzA10Fjl4/6Za71F5KFwJyCkWvUTiJ1n:PGD3oBdXaIjl4yo7pKaEC1vUuz

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2