4.rar
- SHA256 da9aa7f69696a7a84c6596e28cb1b1c926d12a3f69b983b26d62421d78eaf617
Password
idk
Overview
overview
9Static
static
71.bat
windows10-2004-x64
81.bat
windows11-21h2-x64
82.bat
windows10-2004-x64
52.bat
windows11-21h2-x64
53.bat
windows10-2004-x64
13.bat
windows11-21h2-x64
14.bat
windows10-2004-x64
14.bat
windows11-21h2-x64
1AppleCleaner.exe
windows10-2004-x64
9AppleCleaner.exe
windows11-21h2-x64
9Cleaner1.bat
windows10-2004-x64
8Cleaner1.bat
windows11-21h2-x64
8Cleaner2.bat
windows10-2004-x64
1Cleaner2.bat
windows11-21h2-x64
1Cleaner3.bat
windows10-2004-x64
8Cleaner3.bat
windows11-21h2-x64
8Cleaner4.bat
windows10-2004-x64
3Cleaner4.bat
windows11-21h2-x64
3FortniteCleaner.bat
windows10-2004-x64
1FortniteCleaner.bat
windows11-21h2-x64
1Ghost_cleaner1.bat
windows10-2004-x64
7Ghost_cleaner1.bat
windows11-21h2-x64
7Ghost_cleaner2.bat
windows10-2004-x64
7Ghost_cleaner2.bat
windows11-21h2-x64
7Ghost_cleaner3.bat
windows10-2004-x64
7Ghost_cleaner3.bat
windows11-21h2-x64
7Ghost_cleaner4.bat
windows10-2004-x64
7Ghost_cleaner4.bat
windows11-21h2-x64
7Ghost_cleaner5.bat
windows10-2004-x64
9Ghost_cleaner5.bat
windows11-21h2-x64
9Ghosts_For...er.bat
windows10-2004-x64
7Ghosts_For...er.bat
windows11-21h2-x64
7Behavioral task
behavioral1
Sample
1.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
1.bat
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
2.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
2.bat
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
3.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
3.bat
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
4.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
4.bat
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
AppleCleaner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral10
Sample
AppleCleaner.exe
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
150 seconds
Behavioral task
behavioral11
Sample
Cleaner1.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
Cleaner1.bat
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
Cleaner2.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Cleaner2.bat
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Cleaner3.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
Cleaner3.bat
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral17
Sample
Cleaner4.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral18
Sample
Cleaner4.bat
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
FortniteCleaner.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
FortniteCleaner.bat
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
Ghost_cleaner1.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral22
Sample
Ghost_cleaner1.bat
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral23
Sample
Ghost_cleaner2.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
Ghost_cleaner2.bat
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral25
Sample
Ghost_cleaner3.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
Ghost_cleaner3.bat
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
Ghost_cleaner4.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral28
Sample
Ghost_cleaner4.bat
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral29
Sample
Ghost_cleaner5.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral30
Sample
Ghost_cleaner5.bat
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral31
Sample
Ghosts_FortniteCleaner.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral32
Sample
Ghosts_FortniteCleaner.bat
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 4.rar
- Size 4.1MB
- Sample260602-dc5ezscs8x
- SHA256 da9aa7f69696a7a84c6596e28cb1b1c926d12a3f69b983b26d62421d78eaf617
- MD5 95c644990661bd0b6dea9c9a110d1c9a
- SHA1 c092144da34249c596f7871a93075117e93c0053
- SHA512 ae5966826d3ea3328b5bccfda299e15475b4da7db3d704ef926ff6f7d99763001dc6173ca1ce375e1c3ed62a628991ba18f3733b3251b17b91727da8f725b171
- SSDEEP 98304:bm3ecTI5r7Ty5u4xhcGEurYzon8uqp8CMTbmaUo:qucTar7Ty5BHPYzYHqplGmLo
- TLSH T1C216331211765450AD39B83269FAE9FE0F07F2C084AD97BF842F75027D626937F22693
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/AppleCleaner.exe themida - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/AppleCleaner.exe unpack001/Ghosts_Toruney_Cleaner.exe unpack001/cleaner.exe
File Explorer
-
4.rar.rar 4.1MB
-
1.bat.bat 3.2MB
-
2.bat.bat 867KB
-
3.bat1.5MB
-
4.bat.bat 107KB
-
AppleCleaner.exe.exe 3.6MB
-
Cleaner1.bat.bat 4KB
-
Cleaner2.bat22KB
-
Cleaner3.bat.bat 111KB
-
Cleaner4.bat162KB
-
FortniteCleaner.bat.bat 1.5MB
-
Ghost_cleaner1.bat.bat 581KB
-
Ghost_cleaner2.bat.bat 265KB
-
Ghost_cleaner3.bat.bat .vbs 23KB
-
Ghost_cleaner4.bat.bat 106KB
-
Ghost_cleaner5.bat.bat 23KB
-
Ghosts_FortniteCleaner.bat.bat 1.5MB
-
Ghosts_Toruney_Cleaner.exe.exe 135KB
-
Registry.bat159KB
-
cleaner.exe.exe 63KB
-
good one.bat.bat 3.3MB
-
regedit_change.bat361KB
-
traces.bat.bat 866KB
1.bat
- SHA256 2fe645bcbe93398f67d06a80607a0bbe3f1441ecdb02b277fd62dd8e2ad99340
- MD5 e6ee619d82590355f8b9eccfab8cee9f
- SHA1 fe6929f638a394728fbde1b48d21c5a92e4b96d1
- SHA512 d8b7686a1815712ce1495ea1673ea0926c3fee693fd96089f78cf4874bf77796ce2ee8114aa994ce9054b7557040d62c3918b77332ea1571887df650ccea48d3
- SSDEEP 49152:yTOB4ynYygOvXsMruROZyUpWvWOLZkORes:Y
- TLSH T16FE5324162149172D46321CCD7DFA91D396CE08B35E03BE352E9AF4CD88B83C957AEE6
- MD5 SHA1 SHA512 SSDEEP TLSH
2.bat
- SHA256 ce2c58f5eecbf209b2d33b4034c55d36c07da82a9094de99f757a0684f6e4efd
- MD5 0a324989986ed9b4dbf23026bdf2c8e5
- SHA1 b3ceb4e321215785da84f8c83b7792c43f934c04
- SHA512 29830e54265dfcd543f13b3e69354f5048f1055ff56801a494973db6efd383fc02a3aa712bd35c41b929d28eb3c94f2b8282db1657322d28f34f1b597f4057a1
- SSDEEP 3072:iYScHNYScTzg8gvRnvpWyhytyhy6LfgCWcUWgM+4oH9q4gH9/14/I:REwE6l14/I
- TLSH T19A15228163158131D863358DD3AFB9196A69E18B31E137D311FDBB0DD88B82CC276AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
3.bat
- SHA256 e106b60099faa77c101cb9cbc1cde7ec5b909ff995b3039ab0c42c0162fe4c6e
- MD5 7b641c7dc6d9594726ddfe900313fbcc
- SHA1 c66f280e8bc007a6dd88776549e12e215673e4be
- SHA512 d094f7c2abc30752d10ffe6386c8bc7a33671552f05b888a72e9c28ae6b1be336c15b6326ac4d30420066f348ff47de7f99d3ac6f6d7babfa665ddb88b8d8df8
- SSDEEP 49152:CTOB4ynYygOvXsMruROZyUpWvWOLZkORu:T
- TLSH T1857532006260D2B2D46711C8D7DF995C396CE08725E07BA343E6AE8CDDCA43C55BEEDA
- MD5 SHA1 SHA512 SSDEEP TLSH
4.bat
- SHA256 00023ce602db623e47de1029595339eec4ee5019c6017236c9b721cac0ae4032
- MD5 98f1a0eebcb5f4798662a40323b05a7e
- SHA1 068e288005c04b8d859c44d3767613a8036bdb11
- SHA512 6cfda16ce56b1173b91bd86c0f977f022a0b01a77142a15f66d865ee3f00ffee6aa2df7571edcccac41f7d680a9c4c536991abd91e86a00b083b8f9f37a39cf7
- SSDEEP 768:S/KZzmezF/svUsfg8gVhCBL1oPYdxCA1n5xpoL8oPlRPrPEPupL5LvLpLjLgwJyo:Kg8gUDRnvplQL5LvLpLjLnn
- TLSH T1ADB3D292621895B2D96704CC83EF964D3C7CE0C625F137A242F2BE48D94A83C567ADF7
- MD5 SHA1 SHA512 SSDEEP TLSH
AppleCleaner.exe
- SHA256 027d32bf28bf27f41e1a4a883cedf922d0ea1928f5c8024b2702eb70cee6710a
- MD5 5d55189c4f5b49069859724f34597158
- SHA1 c79a67cc70d2a8994d1c1480114c1890ae550f15
- SHA512 bae030f2075d6cdef0ba02533dbd0f5a5ea05a75634af7a7e231c836978e7512e8b237fb6197634b39278383927eec7410b437c52e926623164c3a17b643d00e
- SSDEEP 98304:dB92kxJ9+xRXCoSJB56et0JsX+40Kollv09V/9T:dj2KJ9+xRyXJFt0yX+40xNWZN
- TLSH T1A906337E6C92CD27C4D8423A4E7665ACEA252F2D9DD28FA1CC035F06306B16C7CED5A4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
idk
Minor OS version
0
Major OS version
6
Entry point
6492248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
60KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
13KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=4, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=32, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=6, id=257, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=2, id=260, version=27412,
count=17, id=257, version=27412,
count=297, id=1, productName=Unmarked objects,
count=4, id=265, version=31107,
count=1, id=255, version=31107,
count=1, id=151,
count=1, id=258, version=31107,
Cleaner1.bat
- SHA256 ca7dfbc65c1fde66413b5dd06f763cbe6b8be78c2a3b88030ccd5dfac23c07df
- MD5 ccf667986586fc0ee3a0898629a36ede
- SHA1 6ffaec4689d257344f8edd02d44d8388280fb162
- SHA512 3e7f9b8df4c455595b57c18917ab9092f5cbd08545116788bcfa709e9edc79c36dae51493da7dc19ba04f69067a420755379a5b11a73205bd05b569f3c0c7ff3
- SSDEEP 48:5eB5uGLW8FktI/JHeUsY200qfDTfbi5t2Qzt2Nt2QVt2ttUFt2AAt2Aop+RAULJY:oHeZY2ELTTqMQPdwYrOPT
- TLSH T10D91BF8323974021691230B6EBDF860F6DA8E04F27D9365125F1763AEF468389176FDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Cleaner2.bat
- SHA256 6d8474b60f28ee629a8b0eae25cc8c214d2e45c23e64445105389b530b535819
- MD5 691a8da53eac534e67dd0a1afd8d7829
- SHA1 fe9754ea0817ab1c3b43c3541ec0b8b5fb551aea
- SHA512 667193eee3fceb28c9fdce6017938d87d0666948cee6abe46f36e92055781e30d8e39d3835fcf7d8350f560873065c958e7e0c58aee242f770beade3be27d6f6
- SSDEEP 96:tVeN1ZifiB1ifIXi4C4AySST5bWV7oJnJdwTK4hS9X4V4j4V4z5Rg51fH84f/vWo:OZifinifILh9aswTthIIhU0
- TLSH T1EAA27FA1BFD1E237AD5B421E037EDF1A45AC8C89128511702772BE49E28E43C65F1EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Cleaner3.bat
- SHA256 317142fae707cbac948083d56b1163aa5a6a1b9270031d9e49ea79214ebe99ef
- MD5 7d29dc3ace16b45ae3b437cf8aa7d65f
- SHA1 fbcfde13c5522d808c321c58291cfa962f104655
- SHA512 333d36985afdbe68fbe455d3f59cbe6fc77b0669de44194e07ca28dece06505a1bd5c354ef132df70b936f7ba2740241046b75ab86afbd4728c0da5371e576d9
- SSDEEP 768:zo9R/KZzmezF/svUsfg8gVhCBL1oPYdxCA1n5xpoL8oPlRPrPEPupL5LvLpLjLg3:E9xg8gUDRnvplQL5LvLpLjLnC
- TLSH T137B3E292631895B2D96704CC83EF964D3C7CE0CA21F537A242F2BA48D94A83C557ADF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Cleaner4.bat
- SHA256 11699f90d4533162a3b7ad620b61a9745a9a06989c3b93b217cd10dec64fb0ad
- MD5 8c3967f9be32e3f7d07ee878e1794c13
- SHA1 4b0d632fd8f3d30147f4a5721e6fdfb0b0b470b7
- SHA512 55519fabada9285bd96d043f3128a6ed4dffad624359c47b27342fe63e0e6f24d9cd35f1a7488da627f68146d4d803ee1e4e946384f62f5a1c32c4599d2ff9d4
- SSDEEP 768:xlkTPz5U3/D35lU14IYIXZBMjmgPBpszWQP54Iq5Knz5U3/D35lU14IYIXZBMjmB:Azhzp
- TLSH T120F344045B218001D6F23B4FF52ABD654F6EB24FB5D05AC721AEB70ADCABA4DC3503A5
- MD5 SHA1 SHA512 SSDEEP TLSH
FortniteCleaner.bat
- SHA256 365685c1e71944bc955c6be46cc33a44099bcb0f8c625228e89445f18866b778
- MD5 2429db21a224c48fa6b17e55a6762328
- SHA1 f86eb0c2de25e8970add83b66253d3f18b0994e1
- SHA512 0487e79a9b2b427f8c0e5bb860e78039bcf29626bd58ad8190df858fcfa130d15add3fcd350cdadaccbc1d2e13f822dab76e418029d692d2ccd972594b4c0e23
- SSDEEP 49152:9TOB4ynYygOvXsMruROZyUpWvWOLZkORn:b
- TLSH T1A37532006260D2B2D46711C8D7DF995C396CE08725E07BA343E6AE8CDDCA43C55BEEDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Ghost_cleaner1.bat
- SHA256 d1ef552d446eb507fe476872efe18e76e0890198a8deb563e78b22b4c411c439
- MD5 8b337ed377138886726892733a624e24
- SHA1 8a1c8b34fe7c38cf5d72ed9106defd71778e1495
- SHA512 f5498c58ded38991fb3da53dea11c9e796e27943d9fe5ad17cfc448300b78eaeb190e876347517e5c79769e548a1a68c1aaee89438534c0ca810629ca027aa23
- SSDEEP 1536:LkYLmcHjAkpYLmcTzg8gxDRnvplQL5LvLpLjLwazhztzhzo:LkYScHNYScTzg8glRnvpWzhztzhzo
- TLSH T1A2C4654027248011D5B3364DE66FB8296F6DF18F71E06AC711EEBB0DD89B91CC2752EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Ghost_cleaner2.bat
- SHA256 a3c1a9061c4caddfa5023640eb8c33c3c99859320a8c3164e88facba9166bf35
- MD5 ce55c0703b6be160771e927ba9de028f
- SHA1 144d8889c6d21de0121e189ff3a3d9f607875faf
- SHA512 a71678d1aa93a98c82721b351bb52aa339d374070aa85bb2a5782ee499823234d9bfdca1736c14dcba3626365059798275a6e55864cb7253a1895c91e4b82fdf
- SSDEEP 1536:gwNoZxBOz2oofaCWfr3PwUWgM8361L5LvLpLjL5Gzf4oH9Gzf4gH9c:gLfaCWcUWgM+4oH9q4gH9c
- TLSH T1F744B0926219A632E867108CC3EF855E38B8D08615E137B251F5EE0CD98B83C557BEF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Ghost_cleaner3.bat
- SHA256 6a0a081e956bb8570b273e6d88206f047ba415e633d54199ff1f23346f201d9e
- MD5 8dd0170e85ff789296ea34d4cb82ae36
- SHA1 8667b2bce43ad66a6e2daca9bcb5e2289cc33682
- SHA512 18354d46ef22315b56c9c4e6c8620406892a358730c7d7278c5cc53d4d97b055dec6a57878d978aa1ac25aee4cd24cd769b06030121d644f731486269cdcd8e0
- SSDEEP 96:IVeRHI8UeBVeN1ZifiB1ifIXi4C4AySST5bWV7oJnJdwTK4hS9X4V4j4V4z5Rg5l:IVeRHIKeZifinifILh9aswTthIIhU0
- TLSH T124B290A1BFD1E237AD5B411E037EDF0A85ACC849168412702772BE49E28E43C65F5EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Ghost_cleaner4.bat
- SHA256 3a146cc094d610615883fbcd72097bdf86b48e9c2bc190ae33458f02b0589b8a
- MD5 599c81c06b0f5e86b220d15a4775b4d3
- SHA1 ba21681af9669e77e27186a23dd1176d866cef1e
- SHA512 ae58c6e1bd10f3e3d4b96dca60d5de6dc4efa912af5702d939685c6b9cfa50c52d51114b1bf2a9b62a6e35ab602d33d87eeec37cc19e20ecab2f396d191e2de7
- SSDEEP 768:XX/KZzmezl/svUsfg8gVhCBL1oPY8xC01n5xpoL8oPlRPOpL5LvLpLjLgzJuP:Xvg8gU61nvplxL5LvLpLjLwc
- TLSH T103B3D49263189572D96704CC83EF864D3C7CE0CA25F5376242F2BA48D94A83C967ADF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Ghost_cleaner5.bat
- SHA256 f70f71900d00f4e3fecf0bb8ba9af0670455a07420893f3f5c3e07a961023aa1
- MD5 582d19556759663a6f10f1cbcdb8c7b3
- SHA1 381638fe09bf6e445183a053f0de584c43f64ad8
- SHA512 b37c5b18c112a38ecee4d9f5f9d1231ccf82c848430d408dc49c4f99534a9c63d8f0ef14426a4e2e58a5d5fb0765ce629c7bec438b7b565b3f3cc7d110a7e275
- SSDEEP 96:NVeRHI8UehgRVejIXO4C4AyCT5bWV7oJnJddsK4hSQX4V4j4V4z5ig51fH84f/vy:NVeRHIK6oI3m9asdsth6IhU0M
- TLSH T1E3B2B0A1BFE1E233D96B411A037EDF0A95ACC84A1584117027737A59E28E43C61F5EDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Ghosts_FortniteCleaner.bat
- SHA256 fc5a6bbfcbc91ba982f27afcf525eb516515690ed249b5b6a4be861a1411ec5f
- MD5 413fb52303987394bf98beb4f5499d03
- SHA1 cc0fb83104bb19312ef459a721aa094a2818ec73
- SHA512 c4d0df0ff3473f16317e78422f21d5ef42ed083738c7ff35543dd254529573dc2f0f03f1984f16f5f51d89803465cd226ee32b965938f98d6be0bf6046df618d
- SSDEEP 49152:YTOB4ynYygOvXsMruROZyUpWvWOLZkORn:E
- TLSH T1BD7532006260D2B2D46711C8D7DF995C396CE08725E07BA343E6AE8CDDCA43C55BEEDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Ghosts_Toruney_Cleaner.exe
- IMPHASH 159731ee3c8c9d0496dcd3dc6dfc52a1
- SHA256 d5b857f4972fea91c9d476905d4fb6f80de89df311da0dce83adfbef4d32d1b3
- MD5 03c9069653a814dd3a0d69d1431145eb
- SHA1 d57ca643bfb63dc9df696054ff12770132a81038
- SHA512 b7958fa0c0d2953ed4062f2e241f982377b4b0f990a179da9bf328a39e0a00b79ee76a537cd42482d2d782e33e36f390c85585d88fe16b882e67c4c9edd366cf
- SSDEEP 768:EcLW2SN3ItwfkDG7FIMXVGBzn5v1QLKeJunPxrU+lP/X3Zwkin9Sbh9Sb:LLWDN4qfkDo8z5tMGP9U+BBBuC
- TLSH T17ED3E8439ADC3CC6C038A3B477BB93C5C72EEC9592A2C28F56C01295D9BE55379227D8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
idk
Minor OS version
0
Major OS version
6
Entry point
24272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\User\source\repos\cleaner\cleaner\x64\Release\cleaner.pdb
kernel32
FindFirstFileW
GetStdHandle
SetConsoleTextAttribute
FindClose
CreateFileW
GetLocaleInfoEx
FormatMessageA
LocalFree
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
CloseHandle
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
FindFirstFileExW
advapi32
GetUserNameW
msvcp140
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?good@ios_base@std@@QEBA_NXZ
?_Syserror_map@std@@YAPEBDH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
memcpy
__std_exception_destroy
__std_exception_copy
__std_terminate
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memset
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
malloc
free
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
terminate
_crt_atexit
_cexit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_initialize_onexit_table
_register_onexit_function
_exit
abort
_invalid_parameter_noinfo_noreturn
system
exit
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
92KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=33218,
count=3, id=259, version=33218,
count=27, id=261, version=33218,
count=6, id=257, version=33218,
count=5, id=257, version=30795,
count=130, id=1, productName=Unmarked objects,
count=1, id=265, version=33522,
count=1, id=255, version=33522,
count=1, id=151,
count=1, id=258, version=33522,
Registry.bat
- SHA256 867ebe3a036cdc5c70c2ee267ca4a9124bc717dfb3e73c132dc60a4693a13d24
- MD5 82c83643e937e4802178b2762976275d
- SHA1 260befe1c1cb651f60cd5bf067f0d285922ce916
- SHA512 954e168c4c144d3660a179f1deabb0df521c48a4f635159d65f086b09140f801bbbb912134fab019d9283f575a36f97d3c74067897826a270cceb3f0ff928de9
- SSDEEP 768:R3Slbz5U3/D35lU14IYIXZBMjmgPBpszWQPX4Ir5KYz5U3/D35lU14IYIXZBMjmp:oxXxX
- TLSH T129F344045B214001D6F23B4FF52ABC654FAEB24FB5D05AC721AEB70ADCABA4DC3513A5
- MD5 SHA1 SHA512 SSDEEP TLSH
cleaner.exe
- IMPHASH 04ec74b53750063212aa61296042395d
- SHA256 ce283342401e7fe747fe0ba57befb47465bdfe0f96ddfbeb869496684d6dc967
- MD5 ce27988cc633ed4e1ea1ed4bfd94e6af
- SHA1 ea627f85d7b710266d6eaf4c741fbce49d329c94
- SHA512 6204358139fc5bf8b8b12f8fdcfb5c3f615ce20e651fcb60042376b9d1cf5e5e02ec886a20bdb71ff94ccab16c5881da508431c288e31c9c134dfa10c79e48e3
- SSDEEP 384:y943jeTsybDGc9VIJ9KWSCGEcTvMtpAqFAgZl3QfBX8d7ptPQ9Z7L:vyPLoMMnAGZlGB6PQ9
- TLSH T1EA53085FB7A160FBE5B6C1399AC22219BAB171B403229BCF504115791F707E83C3D799
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
idk
Minor OS version
0
Major OS version
6
Entry point
70247
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\admin\source\repos\cleaner\x64\Debug\cleaner.pdb
vcruntime140d
__vcrt_LoadLibraryExW
__vcrt_GetModuleHandleW
__vcrt_GetModuleFileNameW
__C_specific_handler_noexcept
__current_exception_context
__current_exception
__std_type_info_destroy_list
__C_specific_handler
memcpy
ucrtbased
terminate
strcpy_s
strcat_s
__stdio_common_vsprintf_s
_wmakepath_s
_wsplitpath_s
wcscpy_s
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
__p__commode
_set_new_mode
_configthreadlocale
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_set_fmode
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
__setusermatherr
_set_app_type
_seh_filter_exe
_CrtDbgReportW
_CrtDbgReport
system
_crt_at_quick_exit
kernel32
GetLastError
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetProcAddress
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
RaiseException
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Name
.textbss
Size
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
512B
Virtual Size
379B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
618B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33731,
count=3, id=259, version=33731,
count=11, id=260, version=33731,
count=23, id=261, version=33731,
count=4, id=257, version=30795,
count=70, id=1, productName=Unmarked objects,
count=1, id=261, version=33811,
count=1, id=255, version=33811,
count=1, id=258, version=33811,
good one.bat
- SHA256 bf8229dcbb4fd5705403ce27f92187bb18aba22033741d9226c481a4085903fe
- MD5 f0f4bad659c963e0e1f8baaf578fca2e
- SHA1 c3fddafc0759effc2cec8b1a2d3d814c92a5476a
- SHA512 58eee8e494e1eb0e00640ae9c2cd261e380d203675c8f66f19acefdd88987209f1b7a49d0159b0a52c12f00831053ce5194ccc8a144e47a0259e453ed61b4d6d
- SSDEEP 49152:7TOB4ynYygOvXsMruROZyUpWvWOLZkORZO:e
- TLSH T177F5324162149172D46321CCD7DFA959396CE08B35E03BD312E9BF4CD88B83C967AEE6
- MD5 SHA1 SHA512 SSDEEP TLSH
regedit_change.bat
- SHA256 d73f8099a9125b4cf8932de41114ce9a308c5426f95818b385e3160fb442b558
- MD5 76612436f2530bdedea29c7b93dac4aa
- SHA1 ef4459e02db59572c48c3534dff5138dd2b80c89
- SHA512 b80c3b2819dc633bb6829cf190f3f6852298a11b36ebaed7170252385096e72e241719a18b46ac4c1c822e961d8ac3e0d195bbba9bcbff754f4314df2b9ab988
- SSDEEP 768:+/zTATLU3fjX5F0VYIYIXuhsDGLPhJMT2Nz5U3/D35lU14IYIXZBMjmgPBpszWQZ:3mzozEzozOd5T6E9
- TLSH T10874464427214001D5F23B4FF52ABC654FAEB24FB5D05AC721AEB70AD8ABA4DC3613E5
- MD5 SHA1 SHA512 SSDEEP TLSH
traces.bat
- SHA256 94549cc3627afb5b6fac384a2c76cfd13eecf9b4c446472846e5000230952794
- MD5 445e5d89086ea289363678a826bced03
- SHA1 ff5ffffc89f0f92f99f8c8724481d529f20453cb
- SHA512 7ea8822a6d2b13c30522fd31b9079fe8ddfb4a7ec396fcc1d55e7146a1df7afb0a79989f5e9e8ee04f60bc3511212d3e6d60e693e22bc5610287053cb499be87
- SSDEEP 3072:iYScHNYScTzg8gvRnvpWyhytyhy6LfgCWcUWgM+4oH9q4gH9/142:REwE6l142
- TLSH T19F15228163158131D863358DD3AFB9196A79E18B31E137D311FDBB0DD88B82CC276AE6
- MD5 SHA1 SHA512 SSDEEP TLSH