Extracted

• • Target

    ead121e4d007085adb42edd61c3328aa728fa2c1d7c78e77ceb64f999f7323e3

  • Size

    4.0MB

  • MD5

    128020874e41644b7431278a13dd2635

  • SHA1

    85c877c77e10cf69ec44428e0398eb1e570426d0

  • SHA256

    ead121e4d007085adb42edd61c3328aa728fa2c1d7c78e77ceb64f999f7323e3

  • SHA512

    84055d76dcd1cf28bee65b5d9004e8b92bda0862e2447c7a4023a1abd488e0e1fbcf0d4c28a9a41b8a8b305a7a9adc8b4a6714fbc0a93c1dc58e56214e6737bc

  Score

  10^/10

  oskievasioninfostealerspywarestealerthemidatrojanvmprotect

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2