Extracted

• • Target

    2f98c3eac48e09a6516c8e50c2c9ea8811cebdd61c900416d5976f701dd00cbe

  • Size

    2.2MB

  • MD5

    7d22640a966de6989a327d667236ac25

  • SHA1

    dadc7da5f2a5b720894644839a53759825d786d2

  • SHA256

    2f98c3eac48e09a6516c8e50c2c9ea8811cebdd61c900416d5976f701dd00cbe

  • SHA512

    1c52b2efc012770fa10550f927c3684129b42a96b9d337d61feb1b2b113f10fdbfe8ae3f745f69c1dd504aad2c6d4d70f9444911475fef41e38ae4711357266a

  • SSDEEP

    49152:u3VM/ahIkAwYcLRMyRAwCkTSdl3kQsiuWG+7zqsn0KgqHqesOzwR+:uK4SyRAPuKXbuWG+7Xn0KgqHqx4

  Score

  10^/10

  riseproevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Detects executables packed with Themida

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2