Extracted

• • Target

    b5949697c64f6067497b277e05c9ad0c38adae8c1ef2208e9d00c687f21a7aad

  • Size

    2.4MB

  • MD5

    ef3d0f403a4c93c65ffe12fe0c53afa6

  • SHA1

    d8804cb6c657ff39afdf9d194245c15bfb50a58f

  • SHA256

    b5949697c64f6067497b277e05c9ad0c38adae8c1ef2208e9d00c687f21a7aad

  • SHA512

    146da034513f585723431aca690376cdf5270a706640bddc40e197e4c4409cd2d85df1fd67afceb36a2ad5f4aa63d002e462763250e64482abd95f1f72defd2e

  • SSDEEP

    49152:WloR1qO2TTzANiJR2xaSAkLrAbZqvyo5UbJYb1BtAaooNOc+GRvVvMzqN1SDk7M:WKv52TgNiJeTAFqP6KT+GRpMzw

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2