Extracted

• • Target

    9f7542190d1d41c4f4d773f74a661243d34d90ed75eeb20aa0cb305ea993207d

  • Size

    2.4MB

  • MD5

    c02d9253b290daa8d5a5a1ae32249e03

  • SHA1

    dde1da02262381c991e57c8952aaf3964d401181

  • SHA256

    9f7542190d1d41c4f4d773f74a661243d34d90ed75eeb20aa0cb305ea993207d

  • SHA512

    30731f37a258e40dac5ff8421ed0cdeb61875ecc4c1c545a5435eb37bbc8b15263ad987ba8d73c4c58eab769b5f6c0706fac40dc86250cbd7c595a5302852bc7

  • SSDEEP

    49152:G1RXa0oPKIvya7iVknBihePg/sXveDIXqscUqqgqjzZqGyewKSefT:awP5X7HBAG3X2DIXj3zZqB1KP

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2