Extracted

• • Target

    2b67557576ebddfc21bb692965d5b9621c69b14a724b5c925eaecdb8b8fd5b9b_NeikiAnalytics.exe

  • Size

    2.3MB

  • MD5

    17fa159c918fead6bde477e1823e4a10

  • SHA1

    bebd4162327b3e32dce20e2474af1131ec6585ce

  • SHA256

    2b67557576ebddfc21bb692965d5b9621c69b14a724b5c925eaecdb8b8fd5b9b

  • SHA512

    4e65ad8442676bc65f22ee0d8ed441289b43a9eb48e07f2cf03abdef1358b1303ef7c711fd7b486cf50854a6c9ba652ad778941b9e3676918f5408d0ad604e01

  • SSDEEP

    49152:CaWYa0j8j/eHcyyeOoPbL0COOsnJQHNyGsiJmH1YgSX3P:CFe8jccq0C0nhIX3P

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2