Extracted

• • Target

    1205c112ad35995a65e8131892a89150911994d5a95dbfa114e34857e79a5045.exe

  • Size

    2.2MB

  • MD5

    b2f24660f0c75e0d3a8b553856a348fa

  • SHA1

    be5c9c069bb87ec763fe2f057a0e409c987c0e4a

  • SHA256

    1205c112ad35995a65e8131892a89150911994d5a95dbfa114e34857e79a5045

  • SHA512

    47cd041542d352fc290c455313225b400cc9cf550b4100513ae94e0b4002add84c0dd6e2151cdc49e86acc298f818d397e3f97f330eb405298253017ee87cdab

  • SSDEEP

    49152:MuAbMFmAwbrWM70aYrlc4tf9xoU5t3ghZtkPL26cP0cLsE:UbmmFHWM7vqW4tlxV59yZiD4vwE

  Score

  10^/10

  riseproevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Detects executables packed with Themida

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2