Extracted

• • Target

    a186a21c5024ef2cdb857612bb7ef6e322ef2ccfb1bfae48d462dc5ffd9ccba0.exe

  • Size

    2.3MB

  • MD5

    dbff4297c4294225e0a98f3ff43c6829

  • SHA1

    a3aecf975805e0bb5788199c2e4f66deb707d723

  • SHA256

    a186a21c5024ef2cdb857612bb7ef6e322ef2ccfb1bfae48d462dc5ffd9ccba0

  • SHA512

    ea94100ef930949b10b1962104bef64f626b488dbbc980396fc12294bc3494e7f4b47a7d037f7c5e4db56073ad2b3c4f5ffa259b4249035cefbbebbe1184b9d6

  • SSDEEP

    49152:wGY5918NqwTEgTcnVYn5o8Ry2zPJfl6CAcNEbIinyQTszwp5:BhTiwOD+Bl6IibXL0wn

  Score

  10^/10

  riseprodefense_evasiondiscoverystealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Risepro family

    risepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2