Extracted

• • Target

    ConsoleApplication1_protected.exe

  • Size

    24.9MB

  • MD5

    c79c2a913c7dac3db3567375a7643cfc

  • SHA1

    fa76240f3722352c6598d3992c95cac12dca53c8

  • SHA256

    35e27fd1445c11bcceede5059823629f428058d70d182dffc4d02ce0a5a5ae41

  • SHA512

    990c0f24ba3a96ec21b16b2ce3f9870b4d8fc70a35f66af14b2ca6619545e276a24e5bbb21545befa9e96283e5be07c6481fac24378c6b8257d23105a718b05a

  • SSDEEP

    393216:ZRM3IIVoIhlU9KTC+DMo1UoLEc6+0A65dcbyReDhWARlH7ptR3VeWc8CZkoU:ZS3VoRVNoIcsR5djeDhpRlH7fRIRrk5

  Score

  10^/10

  umbralevasionstealerthemidatrojan

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1