Extracted

• • Target

    cf29d20fa8ebfca0b6cf8b882579ad7a3081fe94225fb5bd41cd3bb20a73f4fe

  • Size

    3.2MB

  • MD5

    77a87284319313b264b9f312cea0b613

  • SHA1

    963241ac47b40e9918a151ed5a98030ae92bc2ff

  • SHA256

    cf29d20fa8ebfca0b6cf8b882579ad7a3081fe94225fb5bd41cd3bb20a73f4fe

  • SHA512

    392bc172ce58c61c37f82f67e964b1239232129159de3167092c6bf15c5893f4d3b511388b3b057321d01a32c80ee8bf9a182a299b2fddc5d2db6ba61cae3a68

  • SSDEEP

    49152:H0yw/KR5uk2bJMpjgLkOz10PQYGeTi6HZ1OzEDj7HLQSUXKr9rgx7mBSlbAV8Zkz:k/KRUkqJfLkYspPO8jL0XyAbzkI8Gi9h

  Score

  10^/10

  riseproevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2