Extracted

• • Target

    df7d46df171369acb6aebafbd51b6141abdc42a3a197a2620fbc6f5f4556a235

  • Size

    2.3MB

  • MD5

    50c7b9b5377a2cc4ec5ac780b0a3a820

  • SHA1

    7071b065db8fcd5d7fce388e1835395c69cd60bc

  • SHA256

    df7d46df171369acb6aebafbd51b6141abdc42a3a197a2620fbc6f5f4556a235

  • SHA512

    1c663103e30ae798f15aa5df3db259b7041dc52bba685058a1c8ea2c856aa12db8e06170ca0ffc80329837c6cfda54079c329e84ad7f21d9f7fc6cefce60cf8b

  • SSDEEP

    49152:FvOqXrR2f5h56HBgWG97LnZwPnO9jkLIUXJ2HPry84cLtpIPdSJ7FQ:xOqXrRm756HBC97Ln40IUUwvrgSJi

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2