Extracted

• • Target

    5e4f50a70deeb3a29049c06b1b3a73abb6def3ddd4bea47dbce78e4eaa941333.exe

  • Size

    2.0MB

  • MD5

    814c7d754de0a807785f32a643082d2b

  • SHA1

    a3f7abb4d5dc8bd5371f2e176b51e8c157b8f4bf

  • SHA256

    5e4f50a70deeb3a29049c06b1b3a73abb6def3ddd4bea47dbce78e4eaa941333

  • SHA512

    68ad7c541ead4d551f586d70644b00f33c5fc14ff8eeb881c4dcef5615bed7b5e196d1d7dd45aae1945c87b26544f826de90a2cc72bef8ccdd4c283594f45486

  • SSDEEP

    49152:Zy5er9fzkC23IfoWxBaVPNb33AVJ6rj3y7JRm1MyV8Wyx:Z4QuJWxBq1b3QXyj3y7JRmCi8Wy

  Score

  10^/10

  discoveryevasionriseprostealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2