Extracted

• • Target

    5ce23e9c7659f50071b949dbb3266c91be7f3d88ab9121b0664600c36274b947

  • Size

    2.3MB

  • MD5

    89a6a8c990b3fb22d031fa910fb3f939

  • SHA1

    d66a8a73f7cad0df02bc5d2e7337e6df8fd3257f

  • SHA256

    5ce23e9c7659f50071b949dbb3266c91be7f3d88ab9121b0664600c36274b947

  • SHA512

    368bd00196a956df950b6dd06c9d0567ed4e6901e2fabb13d3459ab1f57395603013a5393e820fd1d0c13b4256142e80d5d3d2fa7da7e9dea8da0a9a2a5ab795

  • SSDEEP

    49152:/y/cFTyJuY5dOSdaDxFsmePah5jAfPPTOqJ2E5vEye/hdLi/ZLkH5obd0H:lQxdOQaDwdahyXSqJ2EeyUhdUpkqdY

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2