Extracted

• • Target

    b0f736a2ff992a8adc9fe5186368ef213b16cdf26acde6de7a6ec7dd9efa14fd.exe

  • Size

    2.2MB

  • MD5

    6b79ebbf323bc3f77fb55112e9110f12

  • SHA1

    764f8ef62fcbae36f7aa89e7766c171a2cb0d658

  • SHA256

    b0f736a2ff992a8adc9fe5186368ef213b16cdf26acde6de7a6ec7dd9efa14fd

  • SHA512

    e83ef6b9352599a8c0b677f61dc061c89dcd8f45c679533d15219f06ef282e94d1d574d5bbf7798952f091380853a299bca24b7a7ce6512cb6a71694498ff058

  • SSDEEP

    49152:CpzidCiuvctbVbLnkCUJeKDHkQ9bQEc9DQ33/XWfup14n9Od:ogFlbVb7Ke6H9bQ3DQ+fEOO

  Score

  10^/10

  riseprodiscoveryevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2