Extracted

• • Target

    b11106d413ada873be584e41017f785ab636aa19ae276e86c2dc7641fb56a512

  • Size

    8.4MB

  • MD5

    d44fd2a7ae5b182673c1ad4a6019c76a

  • SHA1

    234ace7688c3a25487753fe27e4548388443b667

  • SHA256

    b11106d413ada873be584e41017f785ab636aa19ae276e86c2dc7641fb56a512

  • SHA512

    6a5a2ebfe6e14598cf83d23d70e11e6ac2bbf913f0abe2beb5b824d2049ff98de1ee0b89a88e93ae8818185fc3ea89106a7d98f9aff87703b20eef64a4fa9e41

  • SSDEEP

    98304:/OSD4SVNgaKXCYgTfRIbOEJGdLBWfe0pWqrnWdoHM4EdLIF:/OSdKBScJGxBepEiTiLU

  Score

  10^/10

  allcomeevasionstealerthemidatrojan

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

    stealerallcome

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1