Extracted

• • Target

    da500be2495be18c3b9ed82f974a84e1b7ef34ed781c2e15ebe17ee0e22d4444

  • Size

    2.3MB

  • MD5

    4da402de3eb9d14e07da842a1bbb1abb

  • SHA1

    d9176dce2a5c689d29d7738b0cff3ea9cd8753d1

  • SHA256

    da500be2495be18c3b9ed82f974a84e1b7ef34ed781c2e15ebe17ee0e22d4444

  • SHA512

    03a2d47e68845d6445712903ad84ee929baf2b35d2bb92b549d0c92f840db9a1f95fbd3cc45310572f58024e5751ad30308b08718b0725af1dbb9ced09773e66

  • SSDEEP

    49152:UpN7vg3kgyIyyCasPfwPTbyGMExNhXnjKXDEetQZ:Up/gqksPfI3y0jJ6WZ

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2