Extracted

• • Target

    b272541470c06085f90ea91a5ff0db4e2b74dba64eace22c47f5da25ec940961.exe

  • Size

    4.0MB

  • MD5

    0e7675b5bcb3431b9a51e98c50d4a565

  • SHA1

    91d48e966e4f4d6cb5c02b65cc05498a6a4f2c42

  • SHA256

    b272541470c06085f90ea91a5ff0db4e2b74dba64eace22c47f5da25ec940961

  • SHA512

    e6febe5af954b8a355e7b21a1c2fe8ffd8d60fe6a5fe0ea09906d2ace111590c62d9f7cda31ee3ac89b1419df9623713aa02f381dd55025114b7b146c33efcef

  • SSDEEP

    98304:Ice79JRSezYwrfgq/OyiSlSknT7S9gdfaKHnwFocVxDUQ8PQld/shg:5CFR/rfg+O1MTe9afmocVxDuqdEhg

  Score

  10^/10

  riseprodefense_evasiondiscoverystealertrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Risepro family

    risepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2