Extracted

• • Target
    90ade22e45ff94d9e07b978bb745a5bd
  • Size 4.5MB
  • SHA256 b0b3cf6d05e09c3e051e0a0b653f194c3cafdde345bfd85e6364b3e26a7b6f00
  • MD5 90ade22e45ff94d9e07b978bb745a5bd
  • SHA1 0217c907fe8fc91dbdbfbdb3cbb94d0a482abb0e
  • SHA512 f7a3fcad2828953d7f35fe9d38652f34b97829c4cc31ad1dc163fe5953790518df7cb329c4aebab98fd607af58f0f07ec423ec8f2e43fb57e9c79b24d814499b
  • MD5 SHA1 SHA512

  Score

  10^/10

  recordbreakerevasionstealerthemidatrojanvmprotect

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2