Extracted

• • Target

    0e3b778b34fe8fd7c9a03bad51f56870N.exe

  • Size

    2.4MB

  • MD5

    0e3b778b34fe8fd7c9a03bad51f56870

  • SHA1

    7fce5e78868bc5470653d93a183bccdfdd638f4e

  • SHA256

    9cd46c928c7282585609a42b92f57089275093382cb60fd2657e2b2e9db21291

  • SHA512

    3b402720e6e41779ae55696fbb8d43cc0edbf43108683057fd5c4b3c6ce68a8925792f6c789c8189037fbf3413e0ecae7d2db8792b57f06f61490a024a28ceb3

  • SSDEEP

    49152:LVNy6AznyWSd3tYHxRMJiHDmYH+Hk7NeXibmixFcHF3S:LVobnDSd9ynCJTk7NeSbm3

  Score

  10^/10

  riseprodiscoveryevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2