Overview
overview
3Static
static
3InstallVitalSigns.sh
windows11-21h2-x64
3lib/monito....1.jar
windows11-21h2-x64
1alloy-linux-amd64
windows11-21h2-x64
1lib/monito...porter
windows11-21h2-x64
1instantcli.../adrci
windows11-21h2-x64
1instantcli...genezi
windows11-21h2-x64
1instantcli...o.19.1
windows11-21h2-x64
3oracledb_e...porter
windows11-21h2-x64
1karaf_moni....1.jar
windows11-21h2-x64
1nodejs/Nod...www.js
windows11-21h2-x64
3runtime/ht...64.vbs
windows11-21h2-x64
1runtime/ht...64.vbs
windows11-21h2-x64
1runtime/ht...64.vbs
windows11-21h2-x64
1runtime/li....17.so
windows11-21h2-x64
3servicios/...ing.sh
windows11-21h2-x64
3servicios/...ing.sh
windows11-21h2-x64
3uninstall/...gns.sh
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/06/2026, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
InstallVitalSigns.sh
Resource
win11-20260513-en
Behavioral task
behavioral2
Sample
lib/monitoring_agents/jmx_prometheus_javaagent-1.0.1.jar
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
alloy-linux-amd64
Resource
win11-20260513-en
Behavioral task
behavioral4
Sample
lib/monitoring_agents/redis_exporter
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
instantclient_19_6/adrci
Resource
win11-20260513-en
Behavioral task
behavioral6
Sample
instantclient_19_6/genezi
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
instantclient_19_6/libclntshcore.so.19.1
Resource
win11-20260513-en
Behavioral task
behavioral8
Sample
oracledb_exporter.0.2.8-ora18.5.linux-amd64/oracledb_exporter
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
karaf_monitoring/jmx_prometheus_javaagent-1.0.1.jar
Resource
win11-20260513-en
Behavioral task
behavioral10
Sample
nodejs/NodejsConfi/www.js
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
runtime/httpd-tools/el7/httpd-tools-2.4.6-95.el7.centos.x86_64.vbs
Resource
win11-20260513-en
Behavioral task
behavioral12
Sample
runtime/httpd-tools/el8/httpd-tools-2.4.37-65.0.1.module+el8.10.0+90740+3332f30e.7.x86_64.vbs
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
runtime/httpd-tools/el8/httpd-tools-2.4.37-65.module+el8.10.0+40053+5a18018e.7.x86_64.vbs
Resource
win11-20260513-en
Behavioral task
behavioral14
Sample
runtime/libnsl-2.17.so
Resource
win11-20260513-en
Behavioral task
behavioral15
Sample
servicios/cache_monitoring.sh
Resource
win11-20260513-en
Behavioral task
behavioral16
Sample
servicios/db_monitoring.sh
Resource
win11-20260513-en
Behavioral task
behavioral17
Sample
uninstall/UninstallVitalSigns.sh
Resource
win11-20260513-en
General
- Target instantclient_19_6/libclntshcore.so.19.1
- Size 7.7MB
- Sample260625-vb469sdv5t
- SHA256 603420a74be218df7044ed7e3902c7e42a2321da6288c51b191417c0a9c17fcf
- MD5 0a16cc8caf353d2fa6b74922a86b7737
- SHA1 c9df37d6ca589ddf1f68acc8be8a5fdabc14060b
- SHA512 165b71d6a155009105603b8a79c17b90697f6b7728081bfc56a43f4ef01493b05ee157b92daa32a76a0891a3982f9284bdd0798afb0fe8d28b518e6da5582cb6
- SSDEEP 49152:DpfFdfl+PpesN5+xpS7GiqJqurufIwT4Fhgmbi6cID2SV0mRyZwN1f:Dpfnt+P5eSHfvoqmbipID2SV08UwN1
- TLSH T1EF86080FFCEC85D6C1B27EB639458B32F932B27A0E53AD755901E6086C8D9960127F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings cmd.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4044 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\instantclient_19_6\libclntshcore.so.19.11⤵
- Modifies registry class
PID:1656
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4044