Extracted

• • Target

    b01801b3720b48554db8ad2b0208ab1ab273353f449570cf9825106850b1a8be

  • Size

    2.3MB

  • MD5

    3b5f153018ce6eb72133c9ff8ef47766

  • SHA1

    08655db2180179983e820239a494790f50e28a8c

  • SHA256

    b01801b3720b48554db8ad2b0208ab1ab273353f449570cf9825106850b1a8be

  • SHA512

    41d82bf4d789eb1fe370f81ecce7beaefde3b79069021c66829e51675a2008e5e726d471c9e519b40a01dc2ac0a69b4a6ee595d141608dbfa6012c63852431c3

  • SSDEEP

    49152:G/uzxxah/0tPHRGJdPwVanGgnT8qhFH4rcn5cTPNi9Cg1FAqxHHudr:u8eh/gPH0dPwVUrT8OFHocnB8ggwnud

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2