Extracted

• • Target

    e44bccfb979e50eada5779acf297e0de6028e77d5d5dfd6b5f27550412e1ef12

  • Size

    2.3MB

  • MD5

    53429cc31a0545e536432b4c266f7886

  • SHA1

    cfb4b81b37cb1de7ebbd0f315dc441ac2f5222c3

  • SHA256

    e44bccfb979e50eada5779acf297e0de6028e77d5d5dfd6b5f27550412e1ef12

  • SHA512

    8379f3461e564e03c82cf6baad22fe9983bac777047438edf0882fa669cd58cd551c2d74385f8a9202bd5fe367469098835e90679b37f6064091b2d5f2c64f03

  • SSDEEP

    49152:6qdiwKME9SprJwJN6cUbwg3oO9XZfhXG55HiHR9As:ldiwKX0prJwJNe03MZWHCA

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2