Extracted

• • Target

    fb8f9844273ef9144bb4424bdbb468d9936adfbe82b068570881461d71ad636f.exe

  • Size

    2.2MB

  • MD5

    484f30ebec6067f2fa8469d481894ebd

  • SHA1

    01bdba49aca219240dd2c2901550e605d0564f43

  • SHA256

    fb8f9844273ef9144bb4424bdbb468d9936adfbe82b068570881461d71ad636f

  • SHA512

    49a8be37dd338a43f6edcfdadcaaa130b1dcf73c54d273b62ed8ad23952da42940ac2171336c3fc7f6520aef99d8cf619ec6db3385912de46263a184a307fe6f

  • SSDEEP

    49152:wSUl6vD5DxN6HHLJ9t9ZtmZWmmmR8GfwKDaJ78qEEkIzjbMc/nIjm7:wSSwD5DxkHzjs8GfwDNEW4c/B7

  Score

  10^/10

  riseprodefense_evasiondiscoverystealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Risepro family

    risepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2