Extracted

• • Target

    a593c21b5896c40b375d7baa9b9cb8638b533871f845fd176d3d0963c9872d5d.exe

  • Size

    2.0MB

  • MD5

    a5842900815689efe5842da7f29366f9

  • SHA1

    0358d08e58dda17023d23ae4ff8f232a4ef7f2ba

  • SHA256

    a593c21b5896c40b375d7baa9b9cb8638b533871f845fd176d3d0963c9872d5d

  • SHA512

    575581234e390ea697e2c74867eb302a115fcc30b5f16b4915f6f0097a5500fc8ba671d2f60b9765e693b9458e77cbb7bbe4ed988be950bce6afe1276fede4fc

  • SSDEEP

    49152:/7ciTg0km0ML+1Ky9Hvf+D/2SyfJu0oun1l0ximVgD7sUmVO8:Tcag8/6V9HX+b23Juqn1l0gHyQ8

  Score

  10^/10

  riseprodefense_evasiondiscoverystealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Risepro family

    risepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  behavioral1behavioral2