Extracted

• • Target

    hunta[1].exe

  • Size

    2.3MB

  • MD5

    651de10cfaaa78be50eda9f3f0ce9ea7

  • SHA1

    6b922567fc5880e38fc9a3eacc24f6bab3785731

  • SHA256

    e5cb4f3f8d41c28116b9ff3253ab5f6d6736e18da2d225cf15379954b2751643

  • SHA512

    b3d038963134f43113831d929787aac25e597e17e763c3955660e7d1ed63539c7a929a19a95ae306b390955ffcbad89eb3857402bde3159093ac43dfe9244446

  • SSDEEP

    49152:QSPmGpG0CTiBOGt/tP0HtQ0dcMjXyMxB/x5UGn77l7G4bo8jqOs8DoV:bPmG8HTiVtWQXqiMxVQaRGy3qOs8U

  Score

  10^/10

  riseproaspackv2discoveryevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2