Extracted

• • Target

    43c810e27af8bf4a41c5cbe94f39bcaa24b92c7f01760e41698156c52a6ff8ab

  • Size

    4.2MB

  • MD5

    12d7b7b63d8ea8b173b69246184905d6

  • SHA1

    0eb454a9d47907b5b761af269568a8b6a0fcc21b

  • SHA256

    43c810e27af8bf4a41c5cbe94f39bcaa24b92c7f01760e41698156c52a6ff8ab

  • SHA512

    32b45e13e189b6e482214db1be6e35fc071ae06ebde986f71ba8c8ab792efcfb5cd2e50ff6275ae0831857be031ee8ccc6bc36e77caa1290e1847566e6886e41

  • SSDEEP

    49152:HyRpsgSF3ehDeD8Q3BSgwv3oQ631u+xq3Wr1OyT6m51LKPT9ahmCX49Ad3W6t0Sn:Hs23qc8QYpoQqo4JuT9WmCouW6t0sP

  Score

  10^/10

  riseproevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2