General

  • Target

    UNBAN.zip

  • Size

    35.9MB

  • MD5

    e121dbf20467ae1929b45abe78fbe714

  • SHA1

    c974193f0434b2597e8fa4fb0c27bf448708feb5

  • SHA256

    63735ab7c166ba703679f9917a14c549ca7b1da1d29033b924ee04d1a8eb51b8

  • SHA512

    7a9dcee6eb179b372216a0a013e2f5d76c78dd6d0b671e0d3421ec3e6e86e9c111ae6ab044ad8275c6f50d0d06d46a8bc07326783a619c9c1898359fd60a6a5d

  • SSDEEP

    786432:uzQDXXuNOdLNMWDkCkCYyxhmFUqu+8zgGPui7k9yA2c4/M3XuLcasscJB+Til:uzQDn1NNMWAtTyOpp8lmCXcK/caxcJBL

Malware Config

Signatures

  • Nirsoft 1 IoCs
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 13 IoCs

    Checks for missing Authenticode signature.

Files

  • UNBAN.zip
    .zip
  • UNBAN/Test.bat
  • UNBAN/UTILS/1/KernelMapper.exe
    .exe windows:6 windows x64 arch:x64

    ea1e0cf1f5ea982ff2181b84e3e9ef79


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/UTILS/1/Run Me.exe
    .exe windows:6 windows x64 arch:x64

    08755f1c09cd6042e818084b464b05c9


    Headers

    Imports

    Sections

  • UNBAN/UTILS/1/Test Perm Spoof.exe
    .exe windows:6 windows x64 arch:x64

    397657181a170cedf5596488efef5ae5


    Headers

    Imports

    Sections

  • UNBAN/UTILS/1/amifldrv64.sys
    .sys windows:6 windows x64 arch:x64

    363922cc73591e60f2af113182414230


    Code Sign

    Headers

    Imports

    Sections

  • UNBAN/UTILS/2/Run Me.bat
    .bat .vbs
  • UNBAN/UTILS/2/Volumeid64.exe
    .exe windows:5 windows x64 arch:x64

    735aed1002ee8ff1be0e1dee668e8b0d


    Code Sign

    Headers

    Imports

    Sections

  • UNBAN/UTILS/3/1/DevManView.cfg
  • UNBAN/UTILS/3/1/DevManView.exe
    .exe windows:4 windows x86 arch:x86

    57395b1a198f2bee9d5195fd70610b18


    Code Sign

    Headers

    Imports

    Sections

  • UNBAN/UTILS/3/1/DeviceCleanupCmd.exe
    .exe windows:5 windows x64 arch:x64

    6aa5e2f8804f69cfa4766d009271c7d7


    Code Sign

    Headers

    Imports

    Sections

  • UNBAN/UTILS/3/1/DriveCleanup.exe
    .exe windows:5 windows x64 arch:x64

    53e2fdd9f0e671e26681569046be0658


    Code Sign

    Headers

    Imports

    Sections

  • UNBAN/UTILS/3/1/Run Me.bat
  • UNBAN/UTILS/3/2/1. Xbox hosts, fivem.bat
  • UNBAN/UTILS/3/2/2. Windows Cleanup.bat
  • UNBAN/UTILS/3/2/3. Epic games.bat
  • UNBAN/UTILS/3/2/4. Identifers.bat
  • UNBAN/UTILS/3/2/6 Spoof Mac.bat
    .bat .vbs
  • UNBAN/UTILS/3/2/7. Run Last.bat
  • UNBAN/_internal/PyQt5/Qt5/bin/MSVCP140.dll
    .dll windows:6 windows x64 arch:x64

    01c801a34c4715440ef1f25ad689b315


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/PyQt5/Qt5/bin/MSVCP140_1.dll
    .dll windows:6 windows x64 arch:x64

    a1d1434dddb062f5f5d6615852def52b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/PyQt5/Qt5/bin/Qt5Core.dll
    .dll windows:6 windows x64 arch:x64

    6d44a16d5801e1cdb9b3ba4cb45314b0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/PyQt5/Qt5/bin/VCRUNTIME140.dll
    .dll windows:6 windows x64 arch:x64

    44c3854843f7a3fccdf8ddbbea66f302


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/PyQt5/Qt5/bin/VCRUNTIME140_1.dll
    .dll windows:6 windows x64 arch:x64

    ae0bde6314fa2027b54ce04898f6ab69


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/PyQt5/Qt5/bin/d3dcompiler_47.dll
    .dll windows:6 windows x64 arch:x64

    2ce80dc262aecd9b9f45ee13d6b30c08


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/PyQt5/Qt5/bin/libEGL.dll
    .dll windows:6 windows x64 arch:x64

    2571158206a6160a4e001934364aa256


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/PyQt5/Qt5/bin/libGLESv2.dll
    .dll windows:6 windows x64 arch:x64

    f703387b50fa5341f52a2bbf457da55a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/PyQt5/Qt5/bin/opengl32sw.dll
    .dll windows:6 windows x64 arch:x64

    7c204a15e246f025a7513db5a566a6e9


    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/PyQt5/Qt5/translations/qt_ar.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_bg.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_ca.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_cs.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_da.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_de.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_en.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_es.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_fa.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_fi.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_fr.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_gd.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_gl.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_he.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_ar.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_bg.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_ca.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_cs.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_da.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_de.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_en.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_es.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_fr.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_gl.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_hu.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_it.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_ja.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_ko.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_pl.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_ru.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_sk.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_sl.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_tr.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_uk.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_zh_CN.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_help_zh_TW.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_hu.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_it.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_ja.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_ko.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_lt.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_lv.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_pl.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_pt.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_ru.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_sk.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_sl.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_sv.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_tr.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_uk.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_zh_CN.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qt_zh_TW.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_ar.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_bg.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_ca.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_cs.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_da.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_de.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_en.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_es.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_fi.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_fr.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_gd.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_he.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_hu.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_it.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_ja.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_ko.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_lv.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_pl.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_ru.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_sk.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_tr.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_uk.qm
  • UNBAN/_internal/PyQt5/Qt5/translations/qtbase_zh_TW.qm
  • UNBAN/_internal/PyQt5/QtCore.pyd
    .dll windows:6 windows x64 arch:x64

    5fa8e8e1a536a452c5c43ec429304b40


    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/PyQt5/sip.cp311-win_amd64.pyd
    .dll windows:6 windows x64 arch:x64

    04ef69d8906f92a14be505228b53196e


    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/Pythonwin/mfc140u.dll
    .dll windows:6 windows x64 arch:x64

    7eedc677241d2accda18e4d0e39e2103


    Code Sign

    Headers

    Imports

    Sections

  • UNBAN/_internal/Pythonwin/win32ui.pyd
    .dll windows:6 windows x64 arch:x64

    e957d5741b939d53017aad8c14728bbe


    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/VCRUNTIME140.dll
    .dll windows:6 windows x64 arch:x64

    7f07fd94e5bb907093556781cc464017


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/VCRUNTIME140_1.dll
    .dll windows:6 windows x64 arch:x64

    72707e942878aac770fcc118ce3ec1c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/_bz2.pyd
    .dll windows:6 windows x64 arch:x64

    d0a62ab71a2b2ca69c6aba1f0a37fcdd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/_ctypes.pyd
    .dll windows:6 windows x64 arch:x64

    e716aa549ea6dfb7b233942c7f07ff87


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/_decimal.pyd
    .dll windows:6 windows x64 arch:x64

    c8876e9e8ae3bb7e4abb8348fe33f03e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/_hashlib.pyd
    .dll windows:6 windows x64 arch:x64

    02e7e9437b7e711286b4b21f873e174b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/_lzma.pyd
    .dll windows:6 windows x64 arch:x64

    c39c7a021b2adfc11bb34f105f70355e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/_socket.pyd
    .dll .js windows:6 windows x64 arch:x64 polyglot

    332065e5d19d708832b034da27e5571a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/base_library.zip
    .zip
  • _collections_abc.pyc
  • _weakrefset.pyc
  • abc.pyc
  • codecs.pyc
  • collections/__init__.pyc
  • collections/abc.pyc
  • copyreg.pyc
  • encodings/__init__.pyc
  • encodings/aliases.pyc
  • encodings/ascii.pyc
  • encodings/base64_codec.pyc
  • encodings/big5.pyc
  • encodings/big5hkscs.pyc
  • encodings/bz2_codec.pyc
  • encodings/charmap.pyc
  • encodings/cp037.pyc
  • encodings/cp1006.pyc
  • encodings/cp1026.pyc
  • encodings/cp1125.pyc
  • encodings/cp1140.pyc
  • encodings/cp1250.pyc
  • encodings/cp1251.pyc
  • encodings/cp1252.pyc
  • encodings/cp1253.pyc
  • encodings/cp1254.pyc
  • encodings/cp1255.pyc
  • encodings/cp1256.pyc
  • encodings/cp1257.pyc
  • encodings/cp1258.pyc
  • encodings/cp273.pyc
  • encodings/cp424.pyc
  • encodings/cp437.pyc
  • encodings/cp500.pyc
  • encodings/cp720.pyc
  • encodings/cp737.pyc
  • encodings/cp775.pyc
  • encodings/cp850.pyc
  • encodings/cp852.pyc
  • encodings/cp855.pyc
  • encodings/cp856.pyc
  • encodings/cp857.pyc
  • encodings/cp858.pyc
  • encodings/cp860.pyc
  • encodings/cp861.pyc
  • encodings/cp862.pyc
  • encodings/cp863.pyc
  • encodings/cp864.pyc
  • encodings/cp865.pyc
  • encodings/cp866.pyc
  • encodings/cp869.pyc
  • encodings/cp874.pyc
  • encodings/cp875.pyc
  • encodings/cp932.pyc
  • encodings/cp949.pyc
  • encodings/cp950.pyc
  • encodings/euc_jis_2004.pyc
  • encodings/euc_jisx0213.pyc
  • encodings/euc_jp.pyc
  • encodings/euc_kr.pyc
  • encodings/gb18030.pyc
  • encodings/gb2312.pyc
  • encodings/gbk.pyc
  • encodings/hex_codec.pyc
  • encodings/hp_roman8.pyc
  • encodings/hz.pyc
  • encodings/idna.pyc
  • encodings/iso2022_jp.pyc
  • encodings/iso2022_jp_1.pyc
  • encodings/iso2022_jp_2.pyc
  • encodings/iso2022_jp_2004.pyc
  • encodings/iso2022_jp_3.pyc
  • encodings/iso2022_jp_ext.pyc
  • encodings/iso2022_kr.pyc
  • encodings/iso8859_1.pyc
  • encodings/iso8859_10.pyc
  • encodings/iso8859_11.pyc
  • encodings/iso8859_13.pyc
  • encodings/iso8859_14.pyc
  • encodings/iso8859_15.pyc
  • encodings/iso8859_16.pyc
  • encodings/iso8859_2.pyc
  • encodings/iso8859_3.pyc
  • encodings/iso8859_4.pyc
  • encodings/iso8859_5.pyc
  • encodings/iso8859_6.pyc
  • encodings/iso8859_7.pyc
  • encodings/iso8859_8.pyc
  • encodings/iso8859_9.pyc
  • encodings/johab.pyc
  • encodings/koi8_r.pyc
  • encodings/koi8_t.pyc
  • encodings/koi8_u.pyc
  • encodings/kz1048.pyc
  • encodings/latin_1.pyc
  • encodings/mac_arabic.pyc
  • encodings/mac_croatian.pyc
  • encodings/mac_cyrillic.pyc
  • encodings/mac_farsi.pyc
  • encodings/mac_greek.pyc
  • encodings/mac_iceland.pyc
  • encodings/mac_latin2.pyc
  • encodings/mac_roman.pyc
  • encodings/mac_romanian.pyc
  • encodings/mac_turkish.pyc
  • encodings/mbcs.pyc
  • encodings/oem.pyc
  • encodings/palmos.pyc
  • encodings/ptcp154.pyc
  • encodings/punycode.pyc
  • encodings/quopri_codec.pyc
  • encodings/raw_unicode_escape.pyc
  • encodings/rot_13.pyc
  • encodings/shift_jis.pyc
  • encodings/shift_jis_2004.pyc
  • encodings/shift_jisx0213.pyc
  • encodings/tis_620.pyc
  • encodings/undefined.pyc
  • encodings/unicode_escape.pyc
  • encodings/utf_16.pyc
  • encodings/utf_16_be.pyc
  • encodings/utf_16_le.pyc
  • encodings/utf_32.pyc
  • encodings/utf_32_be.pyc
  • encodings/utf_32_le.pyc
  • encodings/utf_7.pyc
  • encodings/utf_8.pyc
  • encodings/utf_8_sig.pyc
  • encodings/uu_codec.pyc
  • encodings/zlib_codec.pyc
  • enum.pyc
  • functools.pyc
  • genericpath.pyc
  • heapq.pyc
  • io.pyc
  • keyword.pyc
  • linecache.pyc
  • locale.pyc
  • ntpath.pyc
  • operator.pyc
  • os.pyc
  • posixpath.pyc
  • re/__init__.pyc
  • re/_casefix.pyc
  • re/_compiler.pyc
  • re/_constants.pyc
  • re/_parser.pyc
  • reprlib.pyc
  • sre_compile.pyc
  • sre_constants.pyc
  • sre_parse.pyc
  • stat.pyc
  • traceback.pyc
  • types.pyc
  • warnings.pyc
  • weakref.pyc
  • UNBAN/_internal/libcrypto-3.dll
    .dll windows:6 windows x64 arch:x64

    40bce6a23883072a66c68006f08e105c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/libffi-8.dll
    .dll windows:6 windows x64 arch:x64

    3dc8b86d60f90a1851eee5f9dc191312


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/python3.dll
    .dll windows:6 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • UNBAN/_internal/python311.dll
    .dll windows:6 windows x64 arch:x64

    3964207ef92d080d367881cd6d0578d9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/pywin32_system32/pythoncom311.dll
    .dll windows:6 windows x64 arch:x64

    1b264cd576a6b6117b47db03980bc455


    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/pywin32_system32/pywintypes311.dll
    .dll windows:6 windows x64 arch:x64

    5b71a076f0c32bb52117188a36e3fec6


    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/select.pyd
    .dll windows:6 windows x64 arch:x64

    fc4f7d736924aa67a1bd7b7b80894df9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/unicodedata.pyd
    .dll windows:6 windows x64 arch:x64

    bb6f6d951dbdd290ecf382ca57459172


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/win32/_win32sysloader.pyd
    .dll windows:6 windows x64 arch:x64

    0cc37620e20a981eff1969afb8d54d95


    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/win32/win32api.pyd
    .dll windows:6 windows x64 arch:x64

    2000df8846b8f315bdc5cce6da06b275


    Headers

    Imports

    Exports

    Sections

  • UNBAN/_internal/win32/win32trace.pyd
    .dll windows:6 windows x64 arch:x64

    202ab14a040ab62999188829d5316eac


    Headers

    Imports

    Exports

    Sections

  • UNBAN/cleaner/Best Cleaner ( may break some windows features ).bat
  • UNBAN/cleaner/Simple apple cleaner ( best if you dont have deep traces ).exe
    .exe windows:6 windows x64 arch:x64


    Headers

    Sections

  • UNBAN/read me.txt
  • UNBAN/run.bat
  • UNBAN/serialChecker.exe
    .exe windows:5 windows x64 arch:x64

    bae3d3e8262d7ce7e9ee69cc1b630d3a


    Headers

    Imports

    Sections

  • main.pyc