Extracted

• • Target

    3a85101e32db2b212b7049f09ac7d3c910af0871bcae69456321de198454bf3a

  • Size

    2.3MB

  • MD5

    7768809e1c490538cd7b22eddd09552c

  • SHA1

    7f6ae6e675803f1d0bf430e8a218efe2a7caf203

  • SHA256

    3a85101e32db2b212b7049f09ac7d3c910af0871bcae69456321de198454bf3a

  • SHA512

    7ffef5697a1eb35ace6e6885b25f84d1bf6c6b8cd5601e0bdd6a7b53a991a1d6ef706404c4494f97fb8232deacbc9f5f9bfdc84e5ed92bb3ff00dc1f4ae27fdf

  • SSDEEP

    49152:Ovt+czx/ITgr420aBvMRvq0AatAyqe/eHxgjtxV:OV+ze4sNaJv/eR0t

  Score

  10^/10

  riseprodiscoveryevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2