Extracted

• • Target

    14729fa850a4b55c7967fb0a040af3ed82761494e8db674e6273a88e3f6374f7

  • Size

    2.3MB

  • MD5

    34fc2ead9e63bf70e4e17c442fdbd46a

  • SHA1

    a1d60e5c56187662bad7cd2f1974c45f5178cb58

  • SHA256

    14729fa850a4b55c7967fb0a040af3ed82761494e8db674e6273a88e3f6374f7

  • SHA512

    5c2169c3e9d68ff2c9124e20ecf95b5c98fca1fa1f9608088d23dca4a8eb69a5f676bdec6b43873093adfe53a52102192fcee244414484244c5e0382b1b70d5a

  • SSDEEP

    49152:BODuFRwsF2UmOuJr1flsMyAV5T8HWXux5ApZFeK++3OMac2NwN8KhP:w0wGAJr1uMyi82exqZFxa2N9

  Score

  10^/10

  evasionriseprostealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2