Extracted

• • Target

    e35b5f6aa2e9ffc815083030e2c09a5e55df2a02528db2fc24d6f480910f0036.exe

  • Size

    1.9MB

  • MD5

    45d835beaaf607e4ce243297cd053469

  • SHA1

    f96c5d84a6d93983b106cdd5a3daf5900270285d

  • SHA256

    e35b5f6aa2e9ffc815083030e2c09a5e55df2a02528db2fc24d6f480910f0036

  • SHA512

    fcac66d6d78b23e879c9cf993bd79c27edb5e5251c0a347967047c0b7d4d384a5350c45a601e50c70b505631269f53d93cf51b5bade2e3fce669abc31a2202e0

  • SSDEEP

    49152:giBIW7AlKGoEcd/sQmgKkQCsGwJdK9paQNX+x:giyWMlKGoEWsHvNGII7

  Score

  10^/10

  riseprodiscoveryevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2