Extracted

• • Target

    f42d98ec4c311b66ce4b40a98db073cfdf86af1e6fa63b8f9a07555cb4e7958d.exe

  • Size

    3.2MB

  • MD5

    a8b80d67357afbd703ee2a13d9cbf339

  • SHA1

    68620481e594727f1751d84b1e372a5b72d421f9

  • SHA256

    f42d98ec4c311b66ce4b40a98db073cfdf86af1e6fa63b8f9a07555cb4e7958d

  • SHA512

    24c0ca44640a97ccb1a38d8ce98c96e6d307906863db51c433a540212df296136871a2e2f0c628689b20914a64b6f172189b73b391aa0dcfe28449a529e265d5

  • SSDEEP

    98304:R3Z1B/WjR+4+cpPwD2nn8Dw2Urxqs7w5R:fujXdU2Lxp7wz

  Score

  10^/10

  riseproevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2