Extracted

• • Target

    60285015f8b5e32f20411d30b7c64d8748827409275f5a42053b307bc2ff17de.exe

  • Size

    3.0MB

  • MD5

    ee50f2db274c7abdbae3713a14020c24

  • SHA1

    312af659d98d04b23c6ab5f5324604fd04a96777

  • SHA256

    60285015f8b5e32f20411d30b7c64d8748827409275f5a42053b307bc2ff17de

  • SHA512

    bbacd094942f9493d58367d19bf5573331d40c7cd96a2b0d4a787de215e9c3c509c1f2f168b2e632c55686b41ae72713abbe9214c04c889f8d3f18ecda9b6b11

  • SSDEEP

    49152:27lf5RZ4Q9FDCjZtjBJBMndpCqYiCZG5uvmmAwYU9fF4nbGs/cSqyVU5jX:27lf5RWxfaHCqhCZ3dAwY+fFGqnX

  Score

  10^/10

  riseproaspackv2discoverystealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2