Extracted

• • Target

    7dcfeb6bb23fa90b73bbef2e4acd9ca0f40a7d6a9a0a2fee6e896858cda2deab

  • Size

    2.3MB

  • MD5

    f63f2a14cdb4ca1827247ea98e7761ad

  • SHA1

    435c2713f37352f9936e9e67b301df08ba0276be

  • SHA256

    7dcfeb6bb23fa90b73bbef2e4acd9ca0f40a7d6a9a0a2fee6e896858cda2deab

  • SHA512

    755c9317bf61177639657a6073989aee39b42269faa92b3aca2f018616ccfa96706321f2ebaa71b16313277eac31ef516274e0accadd098659e9b9aca8b03aa8

  • SSDEEP

    49152:5rbSPWyqMHg3J/tfEMm0dVlBN1pgpID0Irf889Rx:5/JyQHfEMZdHBmID1oq

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2