Extracted

• • Target

    wm.exe

  • Size

    3.0MB

  • MD5

    1335a17d311b929988693fb526dc4717

  • SHA1

    062830cb07ce430fe049627e001ef23fba8ba351

  • SHA256

    88556497794511dde0ca0a1bfee08922288a620c95a8bc6f67d50dbb81684b22

  • SHA512

    4a4496ed95c7ff13e8735646a6b8c478742a2f152a3733122fcbac54c0cd7c04571acae789c2ac67dc07d542663290c9e32b3335827e122470d8b887477d7bab

  • SSDEEP

    49152:NguQhMOPX5M+RXNM5428gYbM8gkw0Q4qAew+0Fr95s9e54OyRGEK2+qc2LBhW:6/hMOP2a9MLiVed0Zqe54OCGL2NLPW

  Score

  10^/10

  umbralevasionstealerthemidatrojan

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2