Extracted

• • Target

    000a645626a3a63590af8890be4d2bd3ea32490b8844a68f3ada493b97e98c48

  • Size

    3.0MB

  • MD5

    a516ce44268d2bf97d208ccf321f3a99

  • SHA1

    41950e725f721c09173138f63d703e379c525cb6

  • SHA256

    000a645626a3a63590af8890be4d2bd3ea32490b8844a68f3ada493b97e98c48

  • SHA512

    d7cfcaa288321f1edd357ef112f1aaa6601c11e6fa71f0c83a6ba6aa21ea964b54c8450762b4cac708be82ab7ce40b3cd345ecab3ad601ca76624cf1a83414f0

  • SSDEEP

    49152:gfkss8zyBje47r6otsEVftK7eLx604ng5r9rDD:gMgyje47+esEfK7ex6LIZ

  Score

  10^/10

  discoveryevasionriseprostealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Risepro family

    risepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2