61ab765fa1f743d34d84e0415144cbff5604ecb7a91370f1ee658f964602afc9

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/libraries/java/launcher.jar
Size 3.9MB
Sample260628-ev2bqafs2p
SHA256 61ab765fa1f743d34d84e0415144cbff5604ecb7a91370f1ee658f964602afc9
MD5 6e95940ae024d3df5650fb4b41700f98
SHA1 aac608966eb28d03a7293c70d69a43d964d3dab3
SHA512 260b5b6a50ee5df6db1dbfcb38f2dcaf177bd4198271d7eff67b8b6ea178b362d486334a09d82fddee0e41bebb28cba57280a6fe8da615bf57fd0fc3a5fa5e3d
SSDEEP 98304:BC2Ohx/Z31FiSZO9ZmmGaOVsnYalangjF63lOMM+q:zyV98nOVAAa2hM+q
TLSH
T1BA16F1D6FE99C06CE29F5039E00DD82BA87ACD5C8645B04B3A684549C9B6DCC0F92FDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2624	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 5056	2624	java.exe	90
PID 5056 wrote to memory of 1388	5056	cmd.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\resources\libraries\java\launcher.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ""C:\Program Files\Java\jre-1.8\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr
    3⤵
    PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 82e115b6a8427c40bf62ef9592f2eefd58f222aaeaab5c9974d2eaf2e534c53d
MD5 2c93134d41e982b997d0eec2ffaa759f
SHA1 8a101caa217f5053332b7c3b504df93a57971ec7
SHA512 2c9d19f17b64b1ad3ff733feca215d61523f19caf270d63684f85b54d2484619a95aae8b99c185b7a562ae4595ee05c9d9289f920580a326feb3283874ac98d0
MD5 SHA1 SHA512

Submit Download

memory/1388-18-0x000002513C370000-0x000002513C5E0000-memory.dmp

Download

memory/1388-30-0x000002513AB20000-0x000002513AB21000-memory.dmp

Download

memory/1388-31-0x000002513C370000-0x000002513C5E0000-memory.dmp

Download

memory/2624-2-0x0000022DDE950000-0x0000022DDEBC0000-memory.dmp

Download

memory/2624-17-0x0000022DDD170000-0x0000022DDD171000-memory.dmp

Download

memory/2624-20-0x0000022DDD170000-0x0000022DDD171000-memory.dmp

Download

memory/2624-22-0x0000022DDE950000-0x0000022DDEBC0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads