VanishRaider-main.zip
- SHA256 641552853d20e6e3fddef3fa6c2fde8707b68b19b03e2dd4903c7c775c63bcde
Overview
overview
7Static
static
3VanishRaid...LP.txt
windows7-x64
1VanishRaid...LP.txt
windows10-2004-x64
1VanishRaid...DME.md
windows7-x64
3VanishRaid...DME.md
windows10-2004-x64
3VanishRaid...sh.exe
windows7-x64
7VanishRaid...sh.exe
windows10-2004-x64
7main.pyc
windows7-x64
3main.pyc
windows10-2004-x64
3VanishRaid...ts.txt
windows7-x64
1VanishRaid...ts.txt
windows10-2004-x64
1VanishRaid...at.txt
windows7-x64
1VanishRaid...at.txt
windows10-2004-x64
1VanishRaid...src.py
windows7-x64
3VanishRaid...src.py
windows10-2004-x64
3VanishRaid...rt.bat
windows7-x64
7VanishRaid...rt.bat
windows10-2004-x64
7VanishRaid...ns.txt
windows7-x64
1VanishRaid...ns.txt
windows10-2004-x64
1VanishRaid...ff.txt
windows7-x64
1VanishRaid...ff.txt
windows10-2004-x64
1VanishRaid...ns.txt
windows7-x64
1VanishRaid...ns.txt
windows10-2004-x64
1VanishRaid...sh.ico
windows7-x64
3VanishRaid...sh.ico
windows10-2004-x64
3Behavioral task
behavioral1
Sample
VanishRaider-main/HELP.txt
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
VanishRaider-main/HELP.txt
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
VanishRaider-main/README.md
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
VanishRaider-main/README.md
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
VanishRaider-main/Vanish.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
VanishRaider-main/Vanish.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
main.pyc
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
main.pyc
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
VanishRaider-main/requirements.txt
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
VanishRaider-main/requirements.txt
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
VanishRaider-main/scraped/what.txt
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
VanishRaider-main/scraped/what.txt
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
VanishRaider-main/src.py
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
VanishRaider-main/src.py
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
VanishRaider-main/start.bat
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
VanishRaider-main/start.bat
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
VanishRaider-main/stuff/invalid_tokens.txt
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
VanishRaider-main/stuff/invalid_tokens.txt
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
VanishRaider-main/stuff/stuff.txt
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
VanishRaider-main/stuff/stuff.txt
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
VanishRaider-main/tokens.txt
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
VanishRaider-main/tokens.txt
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
VanishRaider-main/vanish.ico
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
VanishRaider-main/vanish.ico
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target VanishRaider-main.zip
- Size 39.9MB
- Sample240619-tp4bfstble
- SHA256 641552853d20e6e3fddef3fa6c2fde8707b68b19b03e2dd4903c7c775c63bcde
- MD5 d37ce8cc7a7764872f64f1ef0684eb90
- SHA1 0d75ff189c9ff5d657ec9c050a7b5a2e9470b6d6
- SHA512 192b028ec425dd5420104681e3684a9f3194585a31b6ed64c4b834ca82dd8bd9b41524b1d8a57f48076cf43a654c5054da631a2cfedc2c24b64f033e13b23b61
- SSDEEP 786432:JmqLlW1n4nb7Hpw5FAYx7/aFh3tJsQq/HZOSx4EXwuCc6kPwq:cqLkl4nb7HK5FAsSFh3tJFq/07EXJ6kr
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/VanishRaider-main/Vanish.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/VanishRaider-main/Vanish.exe
File Explorer
-
VanishRaider-main.zip.zip 39.9MB
-
VanishRaider-main/HELP.txt694B
-
VanishRaider-main/README.md1KB
-
VanishRaider-main/Vanish.exe.exe 40.3MB
-
main.pyc141KB
-
VanishRaider-main/requirements.txt67B
-
VanishRaider-main/scraped/what.txt31B
-
VanishRaider-main/src.py117KB
-
VanishRaider-main/start.bat53B
-
VanishRaider-main/stuff/invalid_tokens.txt2B
-
VanishRaider-main/stuff/stuff.txt2B
-
VanishRaider-main/tokens.txt150B
-
VanishRaider-main/vanish.ico4KB
VanishRaider-main/HELP.txt
- SHA256 58668785a6f2973bb89a3d420dc62a1507aab9dd2526729eaddb2b82785c19af
- MD5 d8b35bddac033f31672e7b68f0917b7d
- SHA1 058ee23a2f4e6271f5cdb9229ab38da9b3cda163
- SHA512 6975e4b7297ea08bc293f101425e5d9b54bdb76798dec837f0254d35009142beb13a5411e879aade4ae5eb07b80c5ae5c3037e1f2c3f25477b3882a14ba7a1b8
- MD5 SHA1 SHA512
VanishRaider-main/README.md
- SHA256 f5cab1f413523a7184b896974e43d43f9704e7b5e4d5e21fcdf5da06e7b61618
- MD5 77262b89c0edbe568d00b4b273a9b67d
- SHA1 e67423667f9621c5d2fe5450342b2794d8c7607a
- SHA512 54e9417a2033091ae58eed44eb66104338b19497048a32143185c0aead5c5d583ee80c31d70b19690a1e553e73dac2e9a69beb3e93787b9bbf26f53c6b12f946
- MD5 SHA1 SHA512
VanishRaider-main/Vanish.exe
- IMPHASH 023abd09c65289e3a2df4aa2b19cccec
- SHA256 8f1047e9d3a102aef242e96caccc328ee6581e3aa0938a26ee433c821276c1ea
- MD5 e93af3c13bbba237beedcfb12bf4bcb2
- SHA1 e275ba9480df0ff294f2200b03e819da25679f81
- SHA512 ceae1fd68f363f04e84bc1e661f9a2bd7b62b10a5ead6ba6bd2446da89dfb613c4ffeb614e9bdd0acae7d6aa2ffc8f7e23be621b25739fb201f2ff7fd6dcb344
- SSDEEP 786432:RWQtsm8NEFG8baD2j6+s7LWB75zupt5F056n+PmBHA+oEt1T:UQtx8NEFG8baD2qHWB75ifzqPmBMEt1T
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
47584
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetWindowThreadProcessId
ShowWindow
kernel32
CreateFileW
GetFinalPathNameByHandleW
CloseHandle
GetModuleFileNameW
CreateSymbolicLinkW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
SetDllDirectoryW
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
GetCurrentProcess
GetCurrentProcessId
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetConsoleWindow
HeapSize
GetLastError
WriteConsoleW
SetEndOfFile
GetExitCodeProcess
TlsGetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
172KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=30795,
count=187, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=4, id=253, version=33030,
count=40, id=261, version=33030,
count=17, id=260, version=33030,
count=17, id=259, version=33030,
count=7, id=257, version=30795,
count=121, id=1, productName=Unmarked objects,
count=21, id=260, version=33135,
count=1, id=258, version=33135,
main.pyc
- SHA256 a4cb1e4e38a672919d96d7d557755bfaf0c029c795a719ccabc09ad56793e061
- MD5 d093e52c67a026dc61704a73befd8587
- SHA1 a590ee278ec5b3c1c35d95bf503909c66db9401a
- SHA512 09bf266d7f1e963b771b1474c3fc689b91d24ab856296e4a72cf27bd56aac8308589f0b336561477eff189e83f1f8f11a1a1f2f3db57687a0e3887629c22c9ac
- SSDEEP 3072:oOlFvhXMhYQiPYaCSNFUqGM7fUz73qYgO/QngI3t1WE:Nlh8hZa7qM7ISQs3WE
- MD5 SHA1 SHA512 SSDEEP
VanishRaider-main/requirements.txt
- SHA256 180acbec533ae024b39346ecfd17f32fde7845e0142ebd29d4b7c47afa8c312f
- MD5 82b7f281497b320b767a40f96164d343
- SHA1 78edaeb06641e29f5afb10749a3d315c1360b055
- SHA512 377c99cf455fdb3175446a347f56894e515e6126c971dc0296074c565df5b15bd22c3967d3ac9684887f33d74bfbdf4a5d30c308f259b3f08586a11bc4f76022
- MD5 SHA1 SHA512
VanishRaider-main/scraped/what.txt
- SHA256 7083819176f1f776dd1b6eaed4c30714c6ec75b68415c74b0ad738ef252c4676
- MD5 a68988f7d7fcee0adde93fc88d553943
- SHA1 e7e95f7beaa3ec8b6eea41f6c6289970421a99d7
- SHA512 c744ceb0a4cf2241e357cdf9587091d3145c73f663d8e284b86a081a99a6d2649c0d990f1111ad7e5ed5375afc0a2e21021adc13b0278fb37d97bd604c401ca2
- MD5 SHA1 SHA512
VanishRaider-main/src.py
- SHA256 c639e24837d454b65002a1ef26e176156b419020ce21eb02d2170204e6d72ec9
- MD5 6d6c43dd517eb918c9a159e0d70f6af5
- SHA1 3b21a24445b9ae57466bc899d786ef0b45d151ad
- SHA512 e0a27cdd14ef51c1f3b6a631a9f8c9c256e5c2a19d07c7db478e77da2e88e3f91e1b5ce9ce51d6188545b09142e89f2c4d07d11a4d2d408a65c751609246e377
- SSDEEP 48:bssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssu:G
- MD5 SHA1 SHA512 SSDEEP
VanishRaider-main/start.bat
- SHA256 7d8faa0857a32fa875367998572eb5a0404cae0a11e34beca1efc16e7c1454b1
- MD5 f852804c49d6334530b82b3c1cf0efa4
- SHA1 34a62d58c044a3e63ca72c60ff424aa833af17a4
- SHA512 4929905adb66b8bc3782dfc4b598d6f159b8b8fb32f966d46a44c2d92a258b45746a6c456b3f0aad016e3b0205d2c50fbfe77dbdab983ddaf88c70185fc4f83f
- MD5 SHA1 SHA512
VanishRaider-main/stuff/invalid_tokens.txt
- SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
- MD5 81051bcc2cf1bedf378224b0a93e2877
- SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
- SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
- MD5 SHA1 SHA512
VanishRaider-main/stuff/stuff.txt
- SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
- MD5 81051bcc2cf1bedf378224b0a93e2877
- SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
- SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
- MD5 SHA1 SHA512
VanishRaider-main/tokens.txt
- SHA256 b367244de9f766d744c128036f134393436550cb2a9551e3b34372cbf8cfb637
- MD5 d47fcc00ca94a9f385c2f18b48cdd5dc
- SHA1 35445e37353aa47608b0933e9dfbfcf738d508a1
- SHA512 7fe992100f14b353abff30c7bc8929a5e2bebe1865363a583955ad6d4d65738f1ba4f309606e9fa3b4fb8d738d5bc5359220c4dc5dfaa29f6ce0be5328157ff0
- MD5 SHA1 SHA512
VanishRaider-main/vanish.ico
- SHA256 eb92a3f8ebb06b22a90815f344cf011063e9b2c31f4dca591d4c2dcc8be6aa03
- MD5 1fc2966af71f9831ca3280a9123a818a
- SHA1 e926c9b1a8315984553562d29d9c21c55362aeeb
- SHA512 743fcf1aefc795f84aed96c1bb73c3ba37428b13f5585e4b219f74454010d17d9e8f5e9b84a8450135883c4fa851efdd82ac08f8e8dd042ca881291788664e66
- SSDEEP 96:2foxDLlllTPPqZ1zhwTbtttS4P0XHGBTxxxxxxxxxRxxxxxxxxxxxxxxxxxxxxxJ:2foxHlllTXqSTbttdP0XHGBTxxxxxxxB
- MD5 SHA1 SHA512 SSDEEP