Extracted

• • Target

    fd89326e6070fac648b9d51b17879f0945d9c6f758cd509a0b437695d1a023b3.exe

  • Size

    3.3MB

  • MD5

    88c55a805ae13377d9f9c25b0331a2cc

  • SHA1

    53f7799c55b7fbc98a31925a6ee804d07ffcd1b9

  • SHA256

    fd89326e6070fac648b9d51b17879f0945d9c6f758cd509a0b437695d1a023b3

  • SHA512

    2aff0b3e9463327954e1991f4ed733e1a8d7c2d01dda008629a81b46531ddb5bdb47710114e96398bf5e54c2f79f7c7706d6acc6d77cae842e3e06386b6b127a

  • SSDEEP

    49152:fpgbMJgHLWpcraT3B84bLP6qMOwG64hjhr0ksfTdFMxX8U88OsrdP1vC6:eMyHLWz3+4HCqMO6Ot96FS8PsXa6

  Score

  10^/10

  riseproevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2