Extracted

• • Target

    be65a0b0c6c457eefa3746d05f00a8d96c61b4d6d3a3ceddd5dcb10f3fe1f151.exe

  • Size

    3.1MB

  • MD5

    ff9e637c32fe8adf2ea4111e2ca90ae7

  • SHA1

    7f458ea730456e73f4356d1867cba635dcdf57d3

  • SHA256

    be65a0b0c6c457eefa3746d05f00a8d96c61b4d6d3a3ceddd5dcb10f3fe1f151

  • SHA512

    aac25c220cc33888b9d888299913a7e04c0e4f0b025023c3722c9668e02255f2d647f0bca654655e626a1c17fa4728df05d675cc02161916737b546fbd5c59d4

  • SSDEEP

    49152:mxxAQNEvHlewpAxotsxlnYqphk7LnotqvL2NwbOEMx:YSGeHlewpA2tsxlnYqphKLnkqj2GbO5

  Score

  10^/10

  riseprodefense_evasiondiscoverystealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Risepro family

    risepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  behavioral1behavioral2