Extracted

• • Target

    c00fb5f31089eb1a997b7a0bbf2cd9c520b2abba86d19026ea40237d99c53cc2

  • Size

    2.3MB

  • MD5

    48bd66cb49e7451cbdb078e2698a1290

  • SHA1

    2a2efd6832e38c8ca141e6b45d2b75144d48a74e

  • SHA256

    c00fb5f31089eb1a997b7a0bbf2cd9c520b2abba86d19026ea40237d99c53cc2

  • SHA512

    d630c43a8547d88e3701d581b783236ffd47bcdf4b3d8280313f686477b0b925c55b25c9f3f2fb82b043388dca04c5f6f88244774c8157cf6b8bbdedf5595f85

  • SSDEEP

    49152:vziXBFivxUdOXjziyqwdXQrsHBM4F4Edi04LivPYX5JY:b4FiZ6qyrsH+24EdZwL

  Score

  10^/10

  riseprodiscoveryevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Risepro family

    risepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2