General
- Target ckey_run.zip
- Size 365KB
- Sample260704-wwqeaaft4n
- SHA256 fe6c75705cd72cb0e77e34b336330d52ee1ede92f16f1e3940717cd6574f55d4
Malware Config
Targets
-
- Target ja-netfilter.jar
- Size 292KB
- SHA256 0100484b6410660eca2c202f4a5bfd907763bdb323e1c07662c12dbde5ba8936
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target plugins-jetbrains/dns.jar
- Size 4KB
- SHA256 d4aaab96c3682f772901ffd5587abf67b7693111aba3dd8594ecb479140f8b84
Score1/10 -
- Target plugins-jetbrains/env.jar
- Size 5KB
- SHA256 9dc98734005393ff9c888be809f8d2ddf4490152377844c76679b5b4a0e788ea
Score1/10 -
- Target plugins-jetbrains/hideme.jar
- Size 7KB
- SHA256 f793c4d9f4ac7b5f43455c8ce84a814253a904e83350f95b0215d4d66aa032d4
Score1/10 -
- Target plugins-jetbrains/native.jar
- Size 4KB
- SHA256 14e4e588abf33678bae57f84c6a61af68ce97552f2aa6883a7fdd46dac956ff5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target plugins-jetbrains/power.jar
- Size 8KB
- SHA256 09fa536905a32569d82e9622ee2a2df1e98cf26eb1e4262d9be5bccfa7693668
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target plugins-jetbrains/privacy.jar
- Size 31KB
- SHA256 acf04040854e5fd816d736875403d2a6215e2cef79dbe5eb8677cd588044151a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target plugins-jetbrains/url.jar
- Size 4KB
- SHA256 1d25c61bbc1ef330e4d7319846d2d72899e90ed5ad7c6387cd73e3b24f5bd179
Score1/10 -
- Target scripts/install-all-users.vbs
- Size 2KB
- SHA256 10b3d96376b6dbf93e642ff4cd14254d0ba1afce10f9f7bb2315b56f42cc944b
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target scripts/install.sh
- Size 3KB
- SHA256 21c4008be4f4c28a9ce3987d3f91801e074c62f8a0efac795519dcaf88d57831
Score3/10 -
- Target scripts/uninstall-all-users.vbs
- Size 1KB
- SHA256 c98703cb2c2ef0c1c526dcdbc36f467f1952541f43f7a7f295412038d0d815fa
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target scripts/uninstall.sh
- Size 1KB
- SHA256 5c408982bcacdcc0af3f0fc9de74d36e8051fbbcf71cbfa5e4ddc1cf3bd5425d
Score3/10 -
- Target vmoptions/phpstorm.key
- Size 61KB
- SHA256 2552f11a20b7b6d6cfcad08b6b0b7e109c095b906afe4817598a11a66479e622
Score4/10