Extracted

• • Target

    tmp

  • Size

    9.1MB

  • MD5

    58ec0acfe4edcc15917b97ef91596f07

  • SHA1

    60e610685d9a549926e7a9b0cb6bcc6509708d3c

  • SHA256

    2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02

  • SHA512

    5769c348149efc107d94bd02e6bbb16440c7974533b843cc42fb7c23fb3e2209754ab69ca9f04a0ba4c56c83e5c30983568a1b1d5f9861c1328befdf09e78736

  • SSDEEP

    196608:K2ejh9Qo2P3Cgnpmtw69DvGSfkDpVpyPc9izcM/WaQCf:Kd4CHx3IyP4izp+Uf

  Score

  10^/10

  allcomeevasionstealerthemidatrojan

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

    stealerallcome

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2