Extracted

• • Target

    3329254a125d793d5786f0c290d71378898a70758c8d9cd4d9695dd4f799ba86.exe

  • Size

    2.2MB

  • MD5

    48e3d13d88f7f4fd76db9e2a7cabbb57

  • SHA1

    7f469c8fef657cbeda31ed92922261eb549bebab

  • SHA256

    3329254a125d793d5786f0c290d71378898a70758c8d9cd4d9695dd4f799ba86

  • SHA512

    8eba62a5e9a531548ab4663493a00f49714df71989f03112dc9a530b7412a0232015bcab8b6d7de7422e2647de72ad49bdd69a7ce033f10fcedc16fff34071aa

  • SSDEEP

    49152:U4lLzU1JzAWWZ3vIE0NrHz493leRqZQO87grozVMpoTWlhR:U4NzU1hAWohQHz49YqZT87grFSqlhR

  Score

  10^/10

  riseproevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Detects executables packed with Themida

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2