Extracted

• • Target

    9c3cdb46ca15b7c867ba2fdaab5f4c48e682ef004de8beac75d7da8186da3f1e.exe

  • Size

    2.1MB

  • MD5

    906505cc5818955f1793017c1d83206d

  • SHA1

    21c7c8ff1b3cd6205d3018da9d449ff30b441db9

  • SHA256

    9c3cdb46ca15b7c867ba2fdaab5f4c48e682ef004de8beac75d7da8186da3f1e

  • SHA512

    d284c6819762a67058cbc1dc8803a787faec7adb68dd95f082d338882b61f616a40e8db5030d82820e3583a47d14b2ea19719b100c738a7ddd702b46a43f894d

  • SSDEEP

    49152:vQgZkd65/+6WUYT+HYNcMT8wDjbS/h2EMxdR+bOZkWSIpxQCRXAFE:4gdk6lmHZa2EmcbOZVSsbXEE

  Score

  10^/10

  riseproevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Detects executables packed with Themida

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2