9565ee8cd89669cfc5bcbff61ecb46266d16a26ac90ee9b46d2ec717a9f5af6d

Resubmissions

06/07/2026, 01:26

06/07/2026, 01:13

06/07/2026, 00:57

max time kernel
899s
max time network
385s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 00:57

Target
heliumcore.jar
Size 14.3MB
Sample260706-bbfdcscw9p
SHA256 9565ee8cd89669cfc5bcbff61ecb46266d16a26ac90ee9b46d2ec717a9f5af6d
MD5 9ab02c4e2b27b1c52bd1dd22cf664990
SHA1 950d5d480b7ef175d382745d0c446f1c3fcd19fe
SHA512 0c4700e85934dc98a400e2bfc0181b2c06874d3170e1f985e59f3bd2e799d9316dcdd86922943b228f0f2c44e432dad387130075eeabae5087fca8f8e00507e3
SSDEEP 196608:TVeZUWiXUxv/IJk3IWhlonJjBoinL7PEZoPrk0iOzx:TE6WiXUxv/IJk3IWhlonJjnWKViO1
TLSH
T123E66B03A2E78EC2F9FF5A74A8F553739567BD59BE32828A01082F3B1C737904651762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5748 wrote to memory of 4292	5748	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\heliumcore.jar -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Suspicious use of WriteProcessMemory
PID:5748
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\heliumcore.jar -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3112

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5624

af_NEUTER.pak

Path C:\Users\Admin\AppData\Local\Temp\ext\assets\heliumcore\force-store\arm64-v8a\stored-locales\af_NEUTER.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download