Extracted

• • Target

    921c5314fc334bac928a8398da1c8341b1021cf92ae83bf8b872d422f2e7ef8f.exe

  • Size

    3.1MB

  • MD5

    ab8e88bff0b907fc49b949d704490018

  • SHA1

    559f2f2b61bd344293f7cbc78b72d8e368910ae3

  • SHA256

    921c5314fc334bac928a8398da1c8341b1021cf92ae83bf8b872d422f2e7ef8f

  • SHA512

    c2388edc661cbaaeccf2ff9a2c153b5d201cf7a2c605570eb992afa3878a0f24c96e1443713e9330833001a4d2be245e6f49f281c663118adeb76ecf7d2e41b5

  • SSDEEP

    98304:e5tF1/fIhf2JK5KtqWaUMrXYQjC4fbEaSNthtA:Ib4haKUt1aUWI4xfbnSHhu

  Score

  10^/10

  riseproevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Detects executables packed with Themida

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2