Extracted

• • Target

    5693684f6c7ff150ef25bdc69eefd0ec9464839accf87ffa92644cd7e410f9f4

  • Size

    464.7MB

  • MD5

    b957effe0c719182022ac9b46b043261

  • SHA1

    07d7157fc342bda8bc403e33b36df39361b60818

  • SHA256

    5693684f6c7ff150ef25bdc69eefd0ec9464839accf87ffa92644cd7e410f9f4

  • SHA512

    1ce8a85296602a71ded0b168fe762254292ff282a9e08abcec3dc4bae68ff7a8b790351538149d92892cdff971778384308779a282c1e6d884f64cb2011269ab

  Score

  10^/10

  recordbreakerevasionstealerthemidatrojan

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

    stealerrecordbreaker

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2