Extracted

• • Target

    ef9029e808dfd848d69f22259d632f67.exe

  • Size

    3.3MB

  • MD5

    ef9029e808dfd848d69f22259d632f67

  • SHA1

    865aad7739c3e98c9467b407fa031d5694baccf5

  • SHA256

    a7e29a0a274f353c1472741fb4db1881989011ae3d76a9904c78ab42ffa2a82d

  • SHA512

    535fb3b98f1090a95be517a73b1d7be61b35b196fa7216e5326e68103380990068c0201b3320822275bea0c2ebd3fffb8154589e83be4ccfcd51b015266be493

  • SSDEEP

    98304:3zg8EJGNcbiELH0k6inOMhtACfUqe2EhgQJg:3zgANcbiED0finOytnq5hgM

  Score

  10^/10

  allcomeevasionstealerthemidatrojan

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

    stealerallcome

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2