Extracted

• • Target

    f1938b9edbedb073a2b3c7e4ae2c2993.exe

  • Size

    3.4MB

  • MD5

    f1938b9edbedb073a2b3c7e4ae2c2993

  • SHA1

    c96a35094c0a9733827d15866a64070899101bfa

  • SHA256

    808ad5c7cb2530b6fd2b30fe163326af54683ecb002f86ab9e8324d10ff450a6

  • SHA512

    d7bb6f2962546e4ffe19ff62289b7cba65a4d34fb0fddddec93e8268ba9642e73ad20487f97ae8543ec4f50df30c63ed749be3b3a8692eb3ee17cae56c9c9219

  • SSDEEP

    98304:6zIdo+CDCuWwkQ98ARbMTe/SBkOwZmbrI6QNaa7dDE:SfDDCuXk2xOamkRZmbrI6MW

  Score

  10^/10

  riseproevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2