Extracted

• • Target

    9e2a3d673b97bbb4b879907a6de4217907800192401dc404af51953e59765838.exe

  • Size

    3.4MB

  • MD5

    910182267ab297ced9fa6cac86f93c3e

  • SHA1

    ba9d0f067c51fa7ab9e2c3af128d4e3a9f2c28b9

  • SHA256

    9e2a3d673b97bbb4b879907a6de4217907800192401dc404af51953e59765838

  • SHA512

    92c313640fddf3ddf0dd6491de8182597df5848240f8791543459240bcf2ceeb8f76e98add171831aaa9fea1001625bbc68f7c5a2f6aebb232f536c1acca0d2a

  • SSDEEP

    49152:J1UHC6vWZtnxJB9qBBmAAcuXshmk2sP4gNi1KEj39tpz7vDZvtNUZRMYDiTYwEqe:J1+WZtzDqBScuXKmk2RXKi17NteXW6S0

  Score

  10^/10

  riseprodiscoveryevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2