Extracted

• • Target

    vxvault.net_0.exe

  • Size

    2.7MB

  • MD5

    d6d04c68b02e6fe72a3ed55ebd36bff0

  • SHA1

    ebf3917deb2d30f95ffedd89bdff3adbc85d74bb

  • SHA256

    90d5d95b3abb09600ea39b9a58968705967cf7747dd18208fb8220c249002725

  • SHA512

    d640502f3e0bbc941c2082f3ebfa805dea8a4d5007b724544c2d7f7af9c96bb766f8e28ce3654adbf273b22c0d54c5e3d241257c4a2936ef781ef2ae9e6ece66

  • SSDEEP

    49152:7RpKlE0flBGyaS+vo+O8KYv5KLSlXIH4lHW5ubiug0+v3N8G:lSBGyaRvog4LSlE4euby9d

  Score

  10^/10

  riseprodiscoveryevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2behavioral3