VanishRaider-main[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
VanishRaider-main.rar
Size 6.3MB
Sample260804-qpparabe88
SHA256 a60f941d59ca4ecf87c9615249bd65e68b7a7a68950e081e060f506a5d47a291
MD5 4b10654057265bfb645f4cfa89d3ff63
SHA1 f80d0b02a76377e5e0d8e20be99dec565b765958
SHA512 1bb5d82d87e6d9e9f52fd503ba365740ae73d2b70dc478325e753f91aa51687344a230e4e23124d130a4e6dacf188f85da025e2bd74ffc64cfe8e6e7413eddc9
SSDEEP 196608:UuFEqmN0/RmVWPrMHxuCrcQjhlvJ94TumSiFOaQ:UuQN0/gVWPYfjhlvkT3tOT
TLSH
T196663320A196DB172FFF92AE5237972EEECF414B4C722CDD37A08C95A7818758E27054
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/VanishRaider-main/main.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/VanishRaider-main/main.exe
unpack002/out.upx

File Explorer

VanishRaider-main.rar

.rar 6.3MB
VanishRaider-main/main.exe

.exe 6.5MB
out.upx

.exe 8.0MB
VanishRaider-main/vanish.ico

2.0MB

VanishRaider-main.rar

SHA256 a60f941d59ca4ecf87c9615249bd65e68b7a7a68950e081e060f506a5d47a291
MD5 4b10654057265bfb645f4cfa89d3ff63
SHA1 f80d0b02a76377e5e0d8e20be99dec565b765958
SHA512 1bb5d82d87e6d9e9f52fd503ba365740ae73d2b70dc478325e753f91aa51687344a230e4e23124d130a4e6dacf188f85da025e2bd74ffc64cfe8e6e7413eddc9
SSDEEP 196608:UuFEqmN0/RmVWPrMHxuCrcQjhlvJ94TumSiFOaQ:UuQN0/gVWPYfjhlvkT3tOT
TLSH
T196663320A196DB172FFF92AE5237972EEECF414B4C722CDD37A08C95A7818758E27054
MD5 SHA1 SHA512 SSDEEP TLSH

VanishRaider-main/main.exe

SHA256 8c0e799108d8f1686839102cc81ec4cc9008b810e722d2a8dd1401d20e956a08
MD5 c754cf71a51c8ac7e121e155ab310dc5
SHA1 a6006efcf466c07d65b1dddc3549fa387b8dd60f
SHA512 adbdf71cedba4742c84de8419178483bae3eb359bf02ac9cd08a93da130ae84e667265f6d39e80c77a7b9b10c96cd26f97f92a0a858ab78c2af12a86028fa0fc
SSDEEP 98304:ytaW5AskzTC6AEjsB/3DNTLQYLTrAS4rAStn3TfV:SchyPhFR4rASd9
TLSH
T17E663321F2CE1C56A75254F8B0FEF6BA917A6D78B4639008F1ED6BA0C01CB0D16F157A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42232656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

out.upx

SHA256 647d96c4d3b9f8dad6481b3b6b5155c0113cb077d2a696fdcda1da03f87c0c36
MD5 1e674acdbe4de67bcc96685e02ebf53b
SHA1 6f97fd86c575722c70156b8d72ea68a26375a8da
SHA512 719d71413dc0a174caf455fcc6a3b664e1e9b9a00659201295b9dbe6244194923bc720b8ad9c4a491361571048b2964afa56a6735481b7adfc8e0553647387f7
SSDEEP 49152:Yx6+dQC8+n+wpmfazY83i4HGHKYFHWlhh+3ms2tja9E2uALlFmtqAPjUk7/0CMOL:YxD+z
TLSH
T145860113FCA118FAC0AE5231896756567B717C881FE123DF2B50B6782FB6BD09879B04
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

531040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

916KB

Virtual Size

915KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.9MB

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

74KB

Virtual Size

32.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

VanishRaider-main.rar

VanishRaider-main/main.exe

generic

out.upx

generic

VanishRaider-main/vanish.ico