Extracted

• • Target

    fee76384c8607145aea5e8e60f00feebe357e404202460c5a0bdb01718bc1db7.exe

  • Size

    3.1MB

  • MD5

    40c43f0a02f466b319a8ad5fbeaab17a

  • SHA1

    0b340dfc80a47a514fd244977159b59d71904abe

  • SHA256

    fee76384c8607145aea5e8e60f00feebe357e404202460c5a0bdb01718bc1db7

  • SHA512

    244fc2b4fd3d87f3c59741f84005c33d892d47d5bfea3c2ba75beb275073bac14ca87a2882d9a9264c0de2b6136c767c10313247a13fa3eb85e055e96537e0fa

  • SSDEEP

    98304:oANQHzuCU4F/hTCePAWFnZRctdxrxXgY6pN:oPHTVhTNAonZetHhgBpN

  Score

  10^/10

  privateloaderriseprodiscoveryevasionloaderpersistencestealerthemidatrojan

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2