Extracted

• • Target

    bea9c215907ee4234731814c1f0a2b736d05d66bb79ea0e2b910052b5b5019d8.exe

  • Size

    2.0MB

  • MD5

    350b77dc4e73b6040a411a6e74bdb4df

  • SHA1

    e8be6a59af69785641463dbf95fa9d2c2ee7d981

  • SHA256

    bea9c215907ee4234731814c1f0a2b736d05d66bb79ea0e2b910052b5b5019d8

  • SHA512

    c19976f61331c1e0aebf61b224c15d304857002b0cdc886427f90ecb23747de38ce6702fdf34a2abdb74adb7fb413a3d0f1db047e1bb152a3cc83f5d7acf2ba7

  • SSDEEP

    24576:b41RuBHoayWe+R85WslbvxN+b3h/CtyoAeWvEcxCgWLBl/Gf3IDYcN6WMUOV49t6:siBIW7Al2xOIe/ngWLBle/HiMU0

  Score

  10^/10

  riseprodefense_evasiondiscoverystealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Risepro family

    risepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  behavioral1behavioral2