Extracted

• • Target

    93dd47da2afc31952d4cff646bc902dd8ec3564896dc7eaf1e1c163549a787c9

  • Size

    6.1MB

  • MD5

    b96494b51a30b3cc1a1063216058eb1c

  • SHA1

    7047fcd8f168324dcd184ab501a15c4f768e361b

  • SHA256

    93dd47da2afc31952d4cff646bc902dd8ec3564896dc7eaf1e1c163549a787c9

  • SHA512

    a13bb12123c1fec3f1dee3df6330d3d104223a2925d25804c61e8edef77479cff7f182750c1de548c40856896be553b1f283a5ad105bd744190ba7a8902dff64

  • SSDEEP

    98304:rtQVcaS/bht7bPGyRXJeMBZz5sAs5cVUH+oeHrYhpkCLBCIgMM1qJ0CO0:B6cLX/PGq4wWcVjYhpkEgM+z0

  Score

  10^/10

  privateloaderriseprodiscoveryevasionloaderpersistencestealerthemidatrojan

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2