The complete guide
to Vortex
Vortex is a multi-layer behavioral threat analysis platform that detects Discord-targeting malware, token stealers, and credential grabbers — before they do damage.
What is Vortex
Vortex is a desktop threat analysis tool built specifically to identify Discord token stealers, credential grabbers, and malware targeting the Discord ecosystem. It combines seven independent analysis layers into a single scored verdict.
Multi-Layer Analysis
Every scan runs Static, YARA, CAPA, VirusTotal, Hybrid Analysis, Sandbox (dynamic), and AI verdict in sequence. All layers contribute to a composite 0–100 risk score — no single method determines the outcome alone.
Discord-Focused Intelligence
Vortex looks specifically for Discord token access, credential exfiltration, Discord API abuse, and webhook callbacks. It distinguishes genuine threats from false-positive cheat injectors and game trainers using behavioral signatures.
Create Account
Registration takes under a minute. Your account is tied to your hardware on first login to prevent sharing.
Register with email, password, and username
Usernames must be 3–24 characters and can only contain letters, numbers, underscores, and dots. VPN use is blocked during registration — disable it before registering. You can change your username later from Profile Settings.
Choose your username thoughtfully — but it's not permanent
Your username is editable at any time from your profile settings page. Your display name, bio, avatar, and pronouns are also freely editable. The only fields that cannot be changed are your email and hardware binding.
Account is bound to your hardware on first login
Your account is permanently linked to the hardware ID of the first device you log in from. This prevents account sharing. Contact the Vortex team to transfer to a new device.
Configure your API keys and VM setup next
After registration, your account is active. Before scanning, add your API keys and ensure your VM environment is correctly configured. See the API Keys and VM Setup sections of this guide.
API Keys
Vortex requires three external API keys. You can add them either through the Settings page inside the tool, or by editing config.json directly. Keys are stored locally and only leave your machine to query their services during a scan.
VirusTotal
Queries VirusTotal's 70+ engine database for exe/dll file cross-referencing. Results return in under 10 seconds for known files.
virustotal_keys array in config.jsonHybrid Analysis
Queries the Hybrid Analysis sandbox database for behavioral reports. Results return in under 10 seconds for known files.
hybridanalysis_keys array in config.jsonOpenRouter
Powers the AI verdict engine. Multiple AI models analyze evidence independently, followed by a final synthesis pass.
openrouter_keys array in config.jsonVM Setup
Vortex's Sandbox (dynamic analysis) requires a specific environment to operate. Without this setup, your original token will at risk — scans still run all other methods with dynamic behavioral detection.
Create a dedicated Virtual Machine
Set up a Windows 10/11 VM using VMware, VirtualBox, or similar software. This VM should be considered expendable — it can be restored from a snapshot at any time. Never use your main machine for Sandbox scanning.
Install Discord with a throwaway account
Install Discord inside the VM. Log in with a fake, dedicated throwaway account — never use your real account. Sandbox Method 1 (GrabberDetector) requires Discord to be actively running when a scan starts. If Discord is not running, scan will be stopped
Install BlueStacks MSI App Player
Download and install BlueStacks MSI App Player (the MSI edition — HD-Player.exe) inside the VM. Vortex's Sandbox uses BlueStacks as an Android emulator during dynamic analysis. Without it, complete scan is stopped.
Run Vortex inside the VM for Sandbox scans
Launch Vortex inside the VM with Discord open and logged in. The Sandbox layer will then be able to execute and monitor suspicious files in a safe, contained environment.
Required Software
- A Windows VM (VMware, VirtualBox, etc.)
- Discord — installed and logged into a fake account
- BlueStacks MSI App Player (HD-Player.exe)
- Vortex installed inside the VM
What Happens Without Setup
- Without Discord running → Scan never runs
- Without BlueStacks → Scan stops
- All other methods (Static, YARA, CAPA, VT, HA, AI) stops
- Your original token can be grabbed
Profile Setup
Your profile is visible to other users — it shows your stats, equipped badges, and the display name attached to all scan records you've submitted.
Editable Fields
- Username — changeable from Profile → Edit Profile
- Display Name — shown on scan records and your profile
- Avatar URL — direct image link for your profile picture
- Bio — short description visible to others
- Pronouns — displayed alongside your name
- Equipped Badges — choose which earned badges to show
- Display Badge — single badge shown on scan record cards
Fixed / Auto-Tracked Fields
- Email — used for login authentication only, cannot change
- Hardware Binding — device locked on first login
- Reputation — earned through scanning, never set manually
- Grabber Detections — auto-tracked confirmed threat count
- Total Badges — auto-counted from earned milestones
How to Scan
Three methods to load a file into Vortex. All three lead to the identical analysis pipeline and produce the same results.
File Browser
Click the upload zone in the Scanner tab. A standard file picker opens — navigate to the target file and click Open to begin analysis.
- Click the upload zone on the Scanner tab
- Navigate to the file in the dialog
- Click Open — scan begins automatically
Drag & Drop
Drag any file from Windows File Explorer and drop it directly onto the Vortex window. Fastest method — zero navigation required.
- Open File Explorer alongside Vortex
- Drag the target file
- Drop onto the Vortex window — instant load
Folder or RAR Archive
Select an entire folder or a RAR archive. Each file inside is scanned through its own pipeline. See Scan Rules for credit deduction details.
- Browse to the folder or .rar file
- Each file is analyzed individually
- Credits deducted per scan rules below
File is hashed — database checked
Vortex computes a SHA-256 hash of the file. If this exact file has been scanned before by any user, the cached result is returned immediately. Your credit is still used — but the result is instant.
Static Analysis + YARA + CAPA run simultaneously
The file is inspected without execution. PE structure, byte patterns, embedded strings, import tables, entropy levels, overlay data, packer detection, and PyInstaller payload extraction are all analyzed.
VirusTotal and Hybrid Analysis are queried
VT and HA are queried by hash for their database results. For known files, both services typically respond in under 10 seconds. If a file is unknown to VT or HA, an upload is performed — you can choose to allow or cancel this upload.
Sandbox runs dynamic behavioral analysis
For supported executable formats, the file is executed in an instrumented environment (requires Discord running + BlueStacks installed in the VM). Sandbox Method 1 monitors GrabberDetector signals and network connections. Method 2 performs deep scans.
AI models produce independent verdicts
Four AI models analyze all gathered evidence independently, each producing a verdict with confidence score and reasoning. A final synthesis pass reviews all prior judgments and produces the definitive classification.
Scan Rules
Understanding when scan credits are deducted prevents unexpected losses and helps you use your daily allocation efficiently.
Free Scan Rules
- Deducted on every scan — new or duplicate
- Deducted on hash matches too
- Not deducted if scan fails to start
- 5 free scans per day per account
- Resets at 12:00 AM IST daily
- Free scans are used before premium credits
Premium Scan Rules
- Only deducted on files not yet in the database
- Zero cost to scan files already in the database
- Credits never expire and never reset
- Automatically used after free scans run out
- Stack seamlessly with daily free scans
- Contact the team for pricing or earn by milestone perks and leaderboard ranks
RAR container itself is scanned first
Vortex first scans the RAR file as a whole (Static, YARA, VirusTotal, Hybrid Analysis, AI). If the RAR container is flagged as malicious, one scan credit is deducted and the process stops — the files inside are not extracted or scanned.
If the RAR is clean, inner files are extracted and scanned individually
No credit is deducted for the Phase A check on a clean RAR. Each extracted inner file then goes through its own complete analysis pipeline. Each inner file that meets its type's completion criteria costs Zero credit.
Reading Results
Every completed scan produces a Risk Score from 0 to 100 and a detection label. These are the primary verdict — everything else is supporting evidence.
| Detection Label | Score | Meaning |
|---|---|---|
| Clean | 0–59 | No significant indicators. File is considered safe. |
| Suspicious | 60–79 | Enough indicators to flag concern. Treat with caution. |
| Highly Suspicious | 80–99 | Strong malicious evidence. Do not open or execute. |
| Discord Token Stealer | 100 / Rule | Confirmed threat. Delete and report immediately. |
| Error | N/A | A method encountered an error and the scan was aborted. Re-scan the file. No credit is saved for aborted scans. |
Analysis Methods
Seven independent analysis layers run in sequence and combine into a weighted composite risk score. Every layer targets a different class of evidence — no single method is more important than the others.
The file is inspected without execution. PE structure, byte patterns, embedded strings, import tables, entropy levels, TLS callbacks, overlay data, packer detection, and PyInstaller payload extraction are all analyzed.
A custom YARA ruleset scans the file's binary content for known Discord stealer behavioral patterns, payload signatures, and obfuscation techniques. YARA matches are weighted in the risk score and passed to the AI models as evidence.
CAPA identifies what capabilities the file has — network access, file system operations, process injection, encryption usage, and more — by matching against a library of known behavioral signatures. Outputs labeled capability categories.
Queries VirusTotal's database using the file's SHA-256 hash to retrieve results from 70+ antivirus engines. For known files, results return in under 10 seconds. Unknown files trigger an upload prompt — you can allow or cancel.
Queries Hybrid Analysis's sandbox database by file hash for existing behavioral reports — threat tags, network behavior, verdicts, and classification labels. For known files, results return in under 10 seconds.
The file is executed inside an instrumented environment. Method 1 (GrabberDetector) monitors Discord process interactions, file system access patterns, and network connections in real time. Method 2 (Blaze Detector) performs deep scan to catch advanced evasion techniques.
Four AI models independently analyze all gathered evidence from every prior method and each produces a verdict with confidence score and written reasoning. A final synthesis pass reviews all prior model judgments and produces the definitive classification label.
Free vs Premium
All users receive 5 free scans per day. The full analysis pipeline — all seven methods — runs identically for both free and premium. The only difference is how credits are deducted.
Every account, every day. No payment. Resets at midnight IST.
- 5 scans per day — resets at 12:00 AM IST
- Complete 7-layer analysis pipeline
- VirusTotal + Hybrid Analysis cross-reference
- Sandbox dynamic behavioral analysis
- Full AI verdict engine (4 models + arbiter)
- Complete risk score and detailed report
- Deducted on both new and duplicate scans
Smart deduction — pay only for genuinely new files.
- Everything in Free — identical pipeline
- Credits never expire — no daily reset
- Zero cost on files already in the database
- 1 scan only on genuinely new files
- Auto-used after daily free scans exhaust
- Stack seamlessly with daily free allocation
- Ideal for bulk scanning sessions
Scan History
Every completed scan is stored in the global database and permanently linked to your account. View your full history from the History tab inside Vortex.
Your History
The History tab shows every scan you've submitted — file name, hash, risk score, detection label, and timestamp. Click any entry to open the full detailed report.
Global Database
Once a scan completes successfully, the file enters the shared global database. Any user scanning the same file gets the cached result instantly. The first submitter is permanently credited as the original discoverer.
Badge System
Badges are milestone awards earned automatically as you scan files and detect threats. Eleven badges across two independent progression tracks.
Reputation grows each time you contribute completed scans to the global database.
Increases each time one of your scans confirms a Discord token stealer.
Badges are milestone awards with real visibility benefits. Here's what earning badges gives you:
Reputation & Stats
Three stats define your community standing. All tracked automatically — you never input them manually.
Reputation
The primary progression metric. Grows as you contribute completed scans to the global database. Determines your rank on the main leaderboard and drives the Analyst badge track.
Grabber Detections
Counts confirmed Discord token stealers you've found. Tracked independently from reputation. Determines your rank on the threat-hunter leaderboard and drives the Hunter badge track.
Total Badges
Your cumulative count of earned milestone badges. Reflects overall achievement across both the Analyst and Hunter tracks. Shown on your profile and the Total Badges leaderboard.
| Stat | What It Tracks | Visible to Others |
|---|---|---|
reputation | Scan contributions to the global database | Yes — profile & leaderboard |
grabberDetections | Confirmed Discord threats discovered | Yes — profile & leaderboard |
badges (count) | Total earned milestone badges | Yes — profile & leaderboard |
freeScansLeft | Remaining free scans for today | Only you |
premiumScans | Remaining premium credit balance | Only you |
Leaderboard
Three separate rankings measure different dimensions of contribution. You can access them from the Leaderboard tab inside Vortex. Earn free scans by achieving Rank 1 by the end of the week (Monday, 12 AM IST). The users who top the Reputation, Grabber Detector, or Total Badges leaderboards will receive premium scans, which will be added directly to their accounts.
Reputation Rank
Rankings by scan contribution to the global database. The most comprehensive measure of community activity and quality.
Grabber Rank
Ranks users by confirmed Discord threat discoveries. A high position means you've been a significant force in identifying real malware in the wild.
Total Badges Rank
Rankings by total number of earned milestone badges. Reflects overall achievement across both Analyst and Hunter badge tracks combined.
Rules & Conduct
Vortex enforces strict policies to maintain integrity. Violations are detected automatically and result in permanent bans with no appeal process.
Prohibited
- Creating more than one account per person or device
- Using VPNs or proxies during account registration
- Sharing your account, session, or credentials
- Attaching debugging tools to the Vortex process
- Intercepting or tampering with Vortex network traffic
- Attempting to reverse-engineer security measures
- Submitting false or fabricated scan data
Permitted
- Scanning any file you have a legitimate reason to analyze
- Using a VPN after registration — login and scanning are fine
- Sharing scan result summaries in communities
- Using all 5 of your free daily scans every day
- Discussing Vortex findings publicly
- Reporting bugs or suspected false positives to the team
Attaching a debugger to the Vortex process triggers an immediate, silent, permanent ban — no warning is given. The ban covers your account, your current IP address, and your original registration IP. All three are blocked simultaneously. IP bans prevent new accounts from being registered from the same IP. There is no manual review process and no appeal path. Any account found violating these rules is permanently banned and cannot be reinstated.
Configure all three API keys before your first scan
Without VirusTotal and Hybrid Analysis keys, those cross-reference layers are skipped. Without your OpenRouter key, the AI verdict engine is disabled. Set up all three before scanning for the most accurate results.
Never close Vortex or disconnect mid-scan
Closing the app or losing internet during a scan aborts the entire scan — which is discarded and not saved. The credit may still be deducted. Always let scans run to full completion.
Protect your config.json file
Your API keys live in config.json. Never share it, include it in screenshots, or upload it anywhere. Anyone with your keys can consume your API quota.
Always run Sandbox scans inside a VM
The Sandbox executes suspicious files. Running this on your real machine is dangerous. Maintain a dedicated VM snapshot you can restore after each scanning session.
FAQ
Download Vortex
Always use the latest version to ensure current detection signatures and server compatibility.
- 7-layer threat analysis: Static, YARA, CAPA, VirusTotal, Hybrid Analysis, Sandbox (dynamic), and AI verdict engine
- Sandbox analysis with GrabberDetector (Method 1) and deep-dive (Method 2)
- Full account system with hardware binding and per-account scan history
- Badge system across two tracks — Analyst (reputation) and Hunter (grabber detections)
- Three-tier leaderboard: Reputation Rank, Grabber Rank, and Total Badges Rank
- Free tier: 5 scans per day with midnight IST reset
- Premium credits with zero-cost duplicate scan advantage
- Global threat database with first-discovery attribution
- 7-layer threat analysis: Static, YARA, CAPA, VirusTotal, Hybrid Analysis, Sandbox (dynamic), and AI verdict engine
- Sandbox analysis with GrabberDetector (Method 1) and deep-dive (Method 2)
- Full account system with hardware binding and per-account scan history
- Badge system across two tracks — Analyst (reputation) and Hunter (grabber detections)
- + 4 more