Extracted

• • Target

    dfc908816343c92250d3fdb30d722a8aedafb906279e0b2ecff373b905e1ebae

  • Size

    2.2MB

  • MD5

    ba9a941cc7e0d9a11c452615355cff3b

  • SHA1

    f15caba9d30e7a04cf867bd384225dc21a51b85e

  • SHA256

    dfc908816343c92250d3fdb30d722a8aedafb906279e0b2ecff373b905e1ebae

  • SHA512

    ab55a125fb1995347b22673dbed3123b909a568e16d28c2dc3e99db34f22b9fa49ba371470d3b3aef2d23af11e1f40b77585d7cc5df5e093b00b7b8a0d6f72bc

  • SSDEEP

    49152:Kndcl4yDcnhfQLmlepEwQfrUVG1PyRnIVZSMpQiyT:KnG4EcnhuiwV6CnwZS9

  Score

  10^/10

  riseproevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2