RETRAC EXT (1).rar
- SHA256 58d643cd9cc66e67ec9752e4dcba30687ac42062bad71107580566e049e525c7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RETRAC EXT/RageWare Retrac EXT.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
retrac cleaner (1).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target RETRAC EXT (1).rar
- Size 529KB
- Sample261002-vbr7pszanb
- SHA256 58d643cd9cc66e67ec9752e4dcba30687ac42062bad71107580566e049e525c7
- MD5 1cf79d547598110cd5b4578d301f97b7
- SHA1 74c8c0f343b72b257dd112c103966d36073a47db
- SHA512 dc592af3afba74cc7f482e3fd091c8ab9d4e1319a7af7864246124061258ff70c0e086c9335fc4b6fb73bd222ba7bbbcee9a72b73d36884ec4b3c0f55d61325e
- SSDEEP 12288:RGa3cBNhyhEIuODlJVlFv9LVgj+Nzb66CO9AnijjgbzErRw0Zi5z:Ma3cBNhwuMlFvYjab621jgbzSR3Zm
- TLSH T14BB4233BA4AB0EEC58CE1121467663F4CB7E6BC4F2486BEA1544E5331D987709FC8D68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/RETRAC EXT/RageWare Retrac EXT.exe
File Explorer
-
RETRAC EXT (1).rar.rar 529KB
-
RETRAC EXT/README.txt99B
-
RETRAC EXT/RageWare Retrac EXT.exe.exe 1.8MB
-
RETRAC EXT/Screenshot 2026-09-06 210547.png.png 136KB
-
retrac cleaner (1).bat7KB
RETRAC EXT/README.txt
- SHA256 eb4bf806bae67f1b943eb24a53deee2ca6cafb3e3b4c64f846e23af3bd692ab6
- MD5 5f45b3aed04a584740485a8a54a33dc8
- SHA1 9b75504cc1aa7aa01ec9f2b23881071b586f563a
- SHA512 597f440f42369a174a7659fc726bf1815f8d0ae6131155ef07ed2c5f4f5f7240584526440c7ad2c1faba32c14a04c968cef24691eb422aeed3e49483e45a2cfd
- TLSH T193B012DFF483003C0611CB8C63891D1062D010E0290F5B48797CD0D85135A2600F1A5D
- MD5 SHA1 SHA512 TLSH
RETRAC EXT/RageWare Retrac EXT.exe
- IMPHASH c291a8d7d2595b744df9ce46c0ee253b
- SHA256 da465668a3c4b5e7f8972e616a091f1e70913f69d13a38b4bb40a0179f395551
- MD5 64c5a022c73e86af5b7a106b7f8bfe40
- SHA1 e9b76cdbd190704c600492ceb7c75f70e9ddf307
- SHA512 0a9a5b166ed80c81cbc48b9b66ca5ad65433c99788cdc332dfe5d15da380dbdbdf9f5f20cacc2d9bc7c799f6d922f488f32a79e2fa357055fa36ee79cc96a3db
- SSDEEP 24576:+Z6D0d0NzXOBLF5n3OgP7o9bgMd+99Jn4X:+cD0UXOBL73tkZgMd+pn4
- TLSH T17495D62476FA15A4C0AAC135E803A767CD307049573D52FF539588C56FF03E8AAFDAA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
682900
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\liamw\Desktop\DRIVER\External-Cheat-Menu-Example-main (1)\External-Cheat-Menu-Example-main\x64\Debug\External-Cheat-Menu.pdb
kernel32
CloseHandle
GetLastError
Sleep
OpenProcess
GetTickCount
ReadProcessMemory
GetModuleHandleA
AllocConsole
CreateToolhelp32Snapshot
Process32First
Process32Next
Module32First
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
GetSystemTimeAsFileTime
LoadLibraryA
RaiseException
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentThreadId
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
VirtualQuery
VerifyVersionInfoW
GetProcAddress
GetModuleHandleW
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
VerSetConditionMask
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
GlobalLock
GlobalUnlock
GetCurrentProcessId
GlobalAlloc
user32
TranslateMessage
DispatchMessageA
PeekMessageA
DefWindowProcA
PostQuitMessage
UnregisterClassA
RegisterClassExA
CreateWindowExA
GetAsyncKeyState
mouse_event
GetSystemMetrics
SetCapture
SetWindowLongW
GetWindowLongW
SetProcessDPIAware
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
AdjustWindowRectEx
GetClientRect
SetWindowTextW
ReleaseDC
GetDC
SetForegroundWindow
EnumDisplayMonitors
OpenClipboard
CloseClipboard
SetClipboardData
GetMonitorInfoW
MonitorFromWindow
LoadCursorW
WindowFromPoint
GetClipboardData
EmptyClipboard
GetCapture
GetKeyState
SetFocus
BringWindowToTop
IsIconic
SetWindowPos
DefWindowProcW
SetLayeredWindowAttributes
ShowWindow
DestroyWindow
GetForegroundWindow
IsChild
CreateWindowExW
RegisterClassExW
UnregisterClassW
ReleaseCapture
gdi32
CreateRectRgn
GetDeviceCaps
CreateFontA
GetTextExtentPoint32A
SelectObject
SetBkMode
SetTextColor
TextOutA
DeleteObject
TextOutW
CreateFontW
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
dwmapi
DwmGetColorizationColor
DwmEnableBlurBehindWindow
DwmIsCompositionEnabled
msvcp140d
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
d3d9
Direct3DCreate9
vcruntime140d
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
__C_specific_handler_noexcept
__current_exception_context
__current_exception
__C_specific_handler
__std_exception_destroy
__vcrt_GetModuleFileNameW
strchr
strstr
memset
memmove
memcpy
memcmp
memchr
__std_exception_copy
__std_type_info_destroy_list
_CxxThrowException
vcruntime140_1d
__CxxFrameHandler4
ucrtbased
floorf
sinf
sqrtf
acosf
ceilf
atof
log
pow
atan2f
logf
powf
_invoke_watson
wcslen
_stricmp
abs
cos
sin
tanf
_CrtDbgReport
freopen_s
__stdio_common_vfprintf
__stdio_common_vsprintf_s
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_CrtDbgReportW
_callnewh
strcpy
_set_app_type
__setusermatherr
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_set_fmode
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
_free_dbg
strcpy_s
strcat_s
_wmakepath_s
_wsplitpath_s
wcscpy_s
__stdio_common_vsprintf
fwrite
ftell
fseek
fread
fflush
fclose
_wfopen
__acrt_iob_func
_wassert
strncpy
strncmp
strlen
strcmp
fmodf
fabs
qsort
malloc
free
cosf
_seh_filter_exe
__stdio_common_vsscanf
toupper
system
Name
.textbss
Size
Virtual Size
653KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
378KB
Virtual Size
378KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1024B
Virtual Size
777B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=257, version=35207,
count=4, id=259, version=35207,
count=11, id=260, version=35207,
count=35, id=261, version=35207,
count=15, id=257, version=33145,
count=218, id=1, productName=Unmarked objects,
count=8, id=261, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
RETRAC EXT/Screenshot 2026-09-06 210547.png
- SHA256 d9660cc43b992b5ff352a82fca466eb0262899cb996e206fc6b98027bcf769fe
- MD5 6b3dfee7693a157ef5160b23d094db46
- SHA1 b957ea4efcafb2edae33c2083981e3f6c6a79d3d
- SHA512 ceddf226092b5da50ce28311ede8122c73ba8bb83043e927745670f26b52fbcc2e858e2d63e421ee8c6b16b7f3c47fba7bb93c6d2b63556e39e49d3b3631e21e
- SSDEEP 3072:5HLOGH5p/cVERFx0rpp9pV6BJDzXnrixFt:hM5p9p4mn
- TLSH T107D312F8AABFD9D4ED2F573C05FB5A38B2E2151C40D0673744B0647DDE1AAE9A608C80
- MD5 SHA1 SHA512 SSDEEP TLSH
retrac cleaner (1).bat
- SHA256 d066952f726e5b71f2fb5e4f5e15a29c1af93052b35d2e4291e0acca1dd5791b
- MD5 709a1d9e8a8858c419945afd85902772
- SHA1 bc57c88e70fb5ce1043bde7990f89850f12accc9
- SHA512 8973f4d9d2692c49a7eb61cd99e524f72230c99b9b496e12caa536c7e10fb5c5c46ca6f4b66c84ecb0665239e47a7ce302e354bb1da457daa72ce23892b8ca21
- SSDEEP 96:jcO56NZi7iBFi5eN+yMDsZFs5BcLuLGvub2VLVua:oO54Zi7iDi5ejYsPsQaTa
- TLSH T19CE19463A675C0215E921517F75DC40B06BEE2CB32025B9031AE77194B498AE21F7FDF
- MD5 SHA1 SHA512 SSDEEP TLSH