Mysterious_Retrac_Cracked.rar
- SHA256 6bd660a15102672b977b879c41e91ff57492ab018d6ac6713c654f03b077b240
Behavioral task
behavioral1
Sample
Mysterious_Retrac_Cracked.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
Mysterious Retrac/1337patcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Mysterious Retrac/Mysterious (2).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Mysterious Retrac/PATCH.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
Mysterious Retrac/patch.1337
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target Mysterious_Retrac_Cracked.rar
- Size 11.2MB
- Sample260809-2nkrqaep2y
- SHA256 6bd660a15102672b977b879c41e91ff57492ab018d6ac6713c654f03b077b240
- MD5 4bd9245d03af9a2576706ea46150c56e
- SHA1 b5d64a7bbbe57e0fc1f286326c79bf9a98161954
- SHA512 637fcc7eaa44f7db797a2a3d509174e94d97b1c3c73b03c30dcfb7ead28975096cf87bab80be5785268057650e9a9a0709cc3495c17e401e37098cb47005f623
- SSDEEP 196608:NUfTbFKYqUkezSMOoLTnIAmYlSOm8+QaLkxYKYgetVLid0rh9WH+cbvhEoWCZc:kbFJnjSMOETntmYlS38+QaLFKYgetxBp
- TLSH T1DAC633A5751F086399F1155053CD8AFF20B3B5C3ACFA53454ADDA0D280A8EF42879BBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Mysterious Retrac/Mysterious (2).exe vmprotect - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Mysterious Retrac/1337patcher.exe unpack001/Mysterious Retrac/Mysterious (2).exe
File Explorer
-
Mysterious_Retrac_Cracked.rar.rar 11.2MB
-
Mysterious Retrac/1337patcher.exe.exe 17KB
-
Mysterious Retrac/Mysterious (2).exe.exe 13.1MB
-
Mysterious Retrac/PATCH.BAT324B
-
Mysterious Retrac/patch.1337144B
Mysterious Retrac/1337patcher.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4e2882e38b927e1e6c457d3fb492b59d014ddb83790b860f4102ba553fa333b7
- MD5 a5e0fd3a628c3b7ddff91e7113b2a68b
- SHA1 5eb1642d333f0ac6aa67c7cdfddffe4ef6dc21ed
- SHA512 5ea45ab813b268e538f808f700eca68d639d6dfdf98c58aa5f965a5f47373700842be9b77db7ea5e1900042187a7733a73d1adeb0d12a07f4be7107c34b9df69
- SSDEEP 384:nDx0aLJE0vtNXwfBLU6TDjxts6uKf29MmKftc:Dx0adEiNgJ40tJeMxfO
- TLSH T1E772D70AB7EC8614F5FF537854F3030106B5B80B6936CB5F2A8D55AF1E237808862BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mysterious Retrac/Mysterious (2).exe
- IMPHASH 28aa075f3898682a3f7b170c02564657
- SHA256 11183ee281a62104b75592c713d8959ff86d35b639a266da4ea8af80d632709d
- MD5 53433e3efc9d9c660b6380399c08e13d
- SHA1 7beef788f1e236a7259d1d5c8cb09591bfa7fe8d
- SHA512 41b03fe779281f2fc59d1806fbbd6d73d6fa31fa973cb785a7cbec67c50866d39dd04b0b4220d965583d076d9588be1458396f09a5512e864a66d80ce7393208
- SSDEEP 393216:mUZm6G8MC6lYFUTBu8IWlKALU51fb8njA6m:m4m6G8MCEYFeMGEcwf6m
- TLSH T1F3D623EA90E522E4E9D309C0768E53CE26D0A15D49DD6C2C399B2C439F36DEF414AE73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
11249090
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
winhttp
WinHttpSendRequest
bcrypt
BCryptCreateHash
crypt32
CryptUnprotectData
iphlpapi
GetAdaptersInfo
advapi32
CryptGetHashParam
kernel32
IsDBCSLeadByte
user32
TranslateMessage
gdi32
GetStockObject
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
msvcp140
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
dwmapi
DwmSetWindowAttribute
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
vcruntime140
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-math-l1-1-0
floorf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
Virtual Size
628KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.vmp0
Size
Virtual Size
7.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp1
Size
1024B
Virtual Size
704B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp2
Size
13.1MB
Virtual Size
13.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Mysterious Retrac/PATCH.BAT
- SHA256 fb433d0b0035234ab82b0bf7a610b89b88e660714df01409ff2135d9cc005500
- MD5 3409e0a96094afa88bc1c30feebd8f1a
- SHA1 c40ac05c6e67b0f05dce0ed762d14c6258fe9184
- SHA512 d94b686071acb42e2d42a8292b9f3154e66a37a908f5b7921be2a9ec583210f44a27b1d1304046ad8f3d78c1c4f555ce998e177c6644c317d7babc1130e66844
- TLSH T1F0E07D9B61CF464A59E012212B2F36D1F49B522BB804244A3476D2AA0747ADA624D98D
- MD5 SHA1 SHA512 TLSH
Mysterious Retrac/patch.1337
- SHA256 97a152f6623929e02ffb1292398482db7fd57f27d85b91684f78b90c73e7d345
- MD5 8fc48371869ebcf36532b2836d032395
- SHA1 df95907acde14493593d7cee8093b616318e5580
- SHA512 1b5a6e240f2d6c0a297cebfe7e986d90a3133359c4858509eb07a6338155a592ee55fcefb7690c3f62574c2b5d754317678bb0861bf298d717a5e30801754c75
- TLSH T195C0118200280FCAC8C023C02BAF3080FCAEBA022CC3000300088F80A00A0BE0B8B03A
- MD5 SHA1 SHA512 TLSH