Extracted

• • Target
    fee76384c8607145aea5e8e60f00feebe357e404202460c5a0bdb01718bc1db7.exe
  • Size 3.1MB
  • SHA256 fee76384c8607145aea5e8e60f00feebe357e404202460c5a0bdb01718bc1db7
  • MD5 40c43f0a02f466b319a8ad5fbeaab17a
  • SHA1 0b340dfc80a47a514fd244977159b59d71904abe
  • SHA512 244fc2b4fd3d87f3c59741f84005c33d892d47d5bfea3c2ba75beb275073bac14ca87a2882d9a9264c0de2b6136c767c10313247a13fa3eb85e055e96537e0fa
  • SSDEEP 98304:oANQHzuCU4F/hTCePAWFnZRctdxrxXgY6pN:oPHTVhTNAonZetHhgBpN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  privateloaderriseprodiscoveryevasionloaderpersistencestealerthemidatrojan

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2