dae0a6a8b4912ae646647274c929172643e60ca7432c4ea9414cff75117ff570

Analysis

max time kernel
109s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Size 911KB
Sample260712-tc28macx2l
SHA256 dae0a6a8b4912ae646647274c929172643e60ca7432c4ea9414cff75117ff570
MD5 deba96fff942422951098c65cffe100d
SHA1 76f46455c7149721b15ac178aa93c7c338b41a76
SHA512 fa54b9565859b67f859d636509fbdc3e7e8a3fdaadfb33c7fea7bdd4b13bc91807b0d09ec75e9a0ec9599a4d9944c892f8f0a8e37616cce1e9ebe663c626149c
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprba:bHuHNgHg1flT/Vk3HYwLfU/rba
TLSH
T159157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5720-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4c6-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5720-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1812-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c9f-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-687.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-982.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1037.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c4c6-6.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c9f-59.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-576.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-687.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-737.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-925.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-982.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1037.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1062.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1123.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1148.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1181.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1219.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1322.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1366.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1379.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1812	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5720	2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
1812	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_deba96fff942422951098c65cffe100d_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5720

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 911KB
SHA256 dae0a6a8b4912ae646647274c929172643e60ca7432c4ea9414cff75117ff570
MD5 deba96fff942422951098c65cffe100d
SHA1 76f46455c7149721b15ac178aa93c7c338b41a76
SHA512 fa54b9565859b67f859d636509fbdc3e7e8a3fdaadfb33c7fea7bdd4b13bc91807b0d09ec75e9a0ec9599a4d9944c892f8f0a8e37616cce1e9ebe663c626149c
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprba:bHuHNgHg1flT/Vk3HYwLfU/rba
TLSH
T159157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 a1e54576ec8e04d39b7a629774ad798dd9084f6b59c0fee90118d80c52cb4a08
MD5 f97080e56ef3bd471ddaf44cbcd47daa
SHA1 85df1a00c626f19498f59a7b07419804ec1b94c5
SHA512 9bdf3a763abe1cb91b9fe16e06eba3e85268d673ecc31311a31bc657162090549ec6f42ab293329db96fd82e094c769f8fab7e05e2371855917e1a641dc10ede
SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfU/rbaP0Le5ji0hmxNrM:T2agnTkLfUePji0Aj
TLSH
T15D656C26FA7486A2D0B3C4B4C9D2974AEA717D510B3086CB9294F32D6E337D19E36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 959KB
SHA256 3ac16f6b801fbde542012406222d58807e825c739d19c0cdaebfd3313988c267
MD5 c292d0843c8cb0d78e330755e08a51af
SHA1 fdfde198638c5658eb792cf4b6dd0868aa494aa0
SHA512 6af6fca101d98bb5885392e4190dd3be82a6e6cc7ef05043994f1b82ea14e067089cc614e84498de4c1818c266608849cab45b8e4f2b41cd567fd8aa6982be14
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbayb:bHuHNgHg1flT/Vk3HYwLfU/rbayb
TLSH
T10C258D23DEA458D2D6B64970DEA6C701D735BE610B2193DFD2A4B31A9E333D02E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 935KB
SHA256 b102d5e75ec1a12088006a543f74e8cb6cebd90b7b14aae8cb9e495490364db9
MD5 3303f0c1608ac902d4931f1e86c3aeb6
SHA1 4ecce567134431c35e26a4d7c883736173d70abe
SHA512 7f31d8538520e693eb3218f7e2bdb4cd8ce9ff1e354eff24f592326105f7b5d15891e7ff6c95361f56c0d5d6bdfd0edc8d8447331df4767b71a3c7aa0c0de46a
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbao6:bHuHNgHg1flT/Vk3HYwLfU/rbao6
TLSH
T1B7157C23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 935KB
SHA256 9231e1b2167c29edc69a05f45451d68b562bd22d9d373e0219fad998a7526926
MD5 777a125459ef6e12122f27c032df9900
SHA1 532f28538256951a508d9037a1d1c309ab60a4c9
SHA512 921cc79871a6d6293cadb6c124bb43c3f1dd7aae7f38440e976c56f9f1a78c1626ba3d5922bc45f529e36d3198fd87c8b11ab51bccf2077c53cfcc62f9c94182
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbasN:bHuHNgHg1flT/Vk3HYwLfU/rbasN
TLSH
T1A3158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 935KB
SHA256 95dfed719ad4761ca296f9309fb903cc48ff1980d7bdbf147a0dab8e9f244846
MD5 6ffe707039404ae78bf330aba115e08c
SHA1 61f2b23dee525876b061e0c54c3ac644ae0c701f
SHA512 96c72d30c47424052f9d6dccc158eb368c9449ccbcf946bbe57ca73a1053f549c99b73be196c16e14c9acbe68308d309480f57b856a2ff1c839b601cd0292077
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaif:bHuHNgHg1flT/Vk3HYwLfU/rbaif
TLSH
T1B3158D23DEA498D2D6A64870DEA68701D735BE610B1193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 935KB
SHA256 5d43cada8c20e8f11975229c06a4ab93aff1bbe5cfef09a6bbf779f0dfb0c00a
MD5 6cd892786423dc421a77bb2322cb6f01
SHA1 2a021d5fd1d2f4292f41a7c82bf91d3a0df92be2
SHA512 fd25d6cf31bd7cb4826bdc31f3c545f35d007edc854e36fcfd2513ad89666950cf78496317b916256b4a823b44c9ee517c356b8b897e2282bb32d28342bd540a
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprba8o:bHuHNgHg1flT/Vk3HYwLfU/rba8o
TLSH
T170158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 935KB
SHA256 f263291c802b2ca02f40e9f488ee58793f2ddfd051ac390fe195ef57cc01e925
MD5 b8303f469e3aa2e7f351e894b71a52fd
SHA1 6f5485146c0cd779570744231cf74e3a984a8699
SHA512 545b0a66fb8a0a6d78e00fa5b788bb08428d7c9e6f5232b036f1fafb726a7793890801157aacb47cb7e8c16b48ed8fcece9dc73f9ae9f872ca6cba8a33492de4
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbacu:bHuHNgHg1flT/Vk3HYwLfU/rbacu
TLSH
T15F158C23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 935KB
SHA256 111b8aa5420d71a5ee376fd55e60f5e2bc1c05b0cb5649b4ad6c22ab13345da8
MD5 4b8b56cf32338c33f4a44ac33e4aa1fe
SHA1 4baddaf617fc9cb196cc6566dd11826b8ea6e475
SHA512 00ab3378a280214684c870f6f1025c5dd89d2a6b33078b650b2262a1b941b2fc3272a045e9ce3636e09886aa5eb9610578227b72d403f4affa97cf59d8434f5f
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbag9:bHuHNgHg1flT/Vk3HYwLfU/rbag9
TLSH
T124158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 935KB
SHA256 9b4aa5eef61bd500fcb8e86df17e2555a413a5a68e3b56074144746031fe46f0
MD5 8d0c8854b4ce5f2e39c720b28caa682b
SHA1 7406cb2204fc9b31b882692d1e46ff6b0d9d9f7f
SHA512 dcd300949414f139452b8bd74aef209039037a11c6dee40cb80b1353c3c8e2c2aac24316b27819c3b39dc5d67c40fc16beb1fa3ab319194295cb39a4013083fa
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaoc:bHuHNgHg1flT/Vk3HYwLfU/rbaoc
TLSH
T1DD158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 935KB
SHA256 b15c9cfec0bc8d9a3935f89b5a769e2b77bea474cd7b68257b02245b631b5e21
MD5 3d38fef918222cc06480d94034e1fbeb
SHA1 41b8c4551e9f5879d24ff1580efce5e202ff6abe
SHA512 8c9f70874d05ab0e6963b1c65d654cd2e49154e147b452b49d94a7670ba367c1dcd0cdbcb107867c9cc9afdc45cc30271971d95f2bafd3d071143860cd555f5e
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaBp:bHuHNgHg1flT/Vk3HYwLfU/rbaBp
TLSH
T1AD158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 935KB
SHA256 d3f4825deb3f92a600dd9d12a1eab0339299e9e9d67c3e05839d0f34e1afe538
MD5 c5f576bc6e140710fd2e4ef3fd9d82e9
SHA1 0dea16ad00b6ba1151c7f2f4117e9824bd81bbc4
SHA512 24f4757ee03a6c98432a4cd7e027ec058fb8b777cc60a50e3b40948e2ba3f991db06eef01cbde30059ca1d648c6dc09d536d33c1dea07b6dda99ba848ab2ad10
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaW0a:bHuHNgHg1flT/Vk3HYwLfU/rbaWN
TLSH
T1C7158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 935KB
SHA256 a24be4b7c50b221c0dd19ab4fa3c630c9ca5fbd46ed769e01d588aeaf8ab035a
MD5 29c8df9eaa4a8c3439d14d9f534f5243
SHA1 67e7251ed4cf0f362c52dd8f96a3adcb6c1e6e98
SHA512 a0fc08599a9fc75ca67b8d6f3b6a55e647256461ac94ddbaa231b89a43a11e98e093af753d53aff6152a91724fa96daef43772617aa3657a7f0e0b434db7ed6f
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaaF:bHuHNgHg1flT/Vk3HYwLfU/rbaaF
TLSH
T162158C23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 935KB
SHA256 97dfd483c3393b1d6485e559df93565270d7db3bc526f6a9d98ba746095f40a2
MD5 20aa1b889baacd04b36b5c834a8aef8d
SHA1 a424b35f29f0901b69b74d0aba9df7cf8a26d788
SHA512 3d390c34fa6e4a94c01959444dfcb8940895a2df77ac3ee6b3b84b8e98a8cbf4fa869328a6732be6fae045191b9fd6d5e81a142c50950346d1f24a32f0ef6af8
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbavC:bHuHNgHg1flT/Vk3HYwLfU/rbavC
TLSH
T16F158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 935KB
SHA256 338ba7ed7014e5da8316c6964fc796c071497fef271e6c22f96db6c559db7ea2
MD5 194643b3062162e4586492eb0f19a677
SHA1 4d7efad11793214f0a9bfed62997d4fbcc9d5795
SHA512 edda42e06e23c2852a85c38b1ecf81c170ba08a7a654288ab6fd6c66a774d5e5c85f70fa266add2a207f1692bd3898b2d97f5f52793cefd3bae2d9cdc3e2bf3a
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaQw:bHuHNgHg1flT/Vk3HYwLfU/rbaQw
TLSH
T142158C23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 935KB
SHA256 05e99e0abab77f56b8e0f808b343bc8944cc416e8798efbfee973a54bafba895
MD5 d3a7f005bd5aa12d27cd872141909a24
SHA1 ace26bcc35a087d91cdf1c70ca3dc3d73e75922e
SHA512 d3c3239de3b94d105adf3fcc55e04abb838d6b454ba75358f9ccadb178c23f0e7abce5e5e65b8aca478738e9f51d55f6447216563f969d2db5723214930bc31a
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbavT:bHuHNgHg1flT/Vk3HYwLfU/rbavT
TLSH
T1A7158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 935KB
SHA256 fc3420ed0c9c7a91840a7e81ca7f619ea825d65c61d3199d1efb533cad1a9dbe
MD5 4b0b2dda7a19986b29d791b4563d6f49
SHA1 64f2cf1d84f60ca3d3753c7d386cd56377533bb7
SHA512 bb52ee81b94b90bfc3393e3d986ddfbd66d87079f97e980a16f7188735a497d19fad4ebd4d5a1ee8ed60817d678fb52c4b81d52d9666b0dad3910d62b7ae2097
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbapu:bHuHNgHg1flT/Vk3HYwLfU/rbapu
TLSH
T15C158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 935KB
SHA256 e474aab516c21a348dea8c95fde749d5ab7e9bde81705ce6807f6b43afe78fcd
MD5 ab51e2bdf6754b24ef787786f9cf3f80
SHA1 f6a2dc8265557188d0b289ff1d4f5f1b09a6d2b6
SHA512 00dd19b3ec615eaf464a176c7a4450e7203a5ead9f409d55572edfb23efd549df44e01e319bba9dd8e2ae74ae16e9ade5ff3b4d719dc0e0485427041107ea899
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbahb:bHuHNgHg1flT/Vk3HYwLfU/rbahb
TLSH
T15F158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 935KB
SHA256 7010dfe162f1b424db29aa93fe8361da951df958f15f863f41657e08bc92e6f9
MD5 df68eb0e4d7df70c33cd32b99c536e9e
SHA1 da0c4da7269bd1b30d59bd106b3a396c4f4686bb
SHA512 0168f817626e85275efb70fab29f5d6a54ba2c81b22601beaef2a53d251992f292221b61344a9387f8be804a292e952957c5bbc9b5ab3f462ce8aa52238fb672
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbapf:bHuHNgHg1flT/Vk3HYwLfU/rbapf
TLSH
T169158D23DEA498D2D6A64870DE968701D735BE610B1193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 935KB
SHA256 b70f7e64e2cac35d89303bba989dcd6d2c3c87e885ca76dc143cc61e921c972b
MD5 f7258619331e5006a43668ccaf2bafe0
SHA1 0eac07c9955ab21e9345548ef4176745e6359c47
SHA512 f7e20dc31a7c0459af74ae73bd34e0d1fae169d1db81393956da45de13e27fbdaaf0e626c98c51853411169aef349d74019c70b48803ba92c7e3ee2e8d23db22
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaSK:bHuHNgHg1flT/Vk3HYwLfU/rbaSK
TLSH
T111158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 935KB
SHA256 e5192a9a2e5716a476c773f39bd1202583f970c41075ca0c3bfb7b518b6dd433
MD5 bec937e25d58fd2f0dbbc902011bd868
SHA1 253fe8a6cf461c43678252c982f21b156bd9b6e8
SHA512 aa3b27fc6ffc96d64afb1abdf660b841d94addeecc771c911e5c87cb8401925573876e7a2036f781dda53c644dd883f9e33db95ca9948bc1a944e1de943a404d
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprba3k:bHuHNgHg1flT/Vk3HYwLfU/rba3k
TLSH
T1A8158C23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 935KB
SHA256 7a4dfa0d6ccf497575c0494f999199a0a2df2d92f3784f25fcad0bd07bde066f
MD5 40984d90ed135831239931507834b9ac
SHA1 2a2aa69c511339ebb3b92059407dba84ab2ff791
SHA512 ac847b547a147cb372cf218840b802f2377cd504be246bacadff7c63dc268f831ab3e322e7ab07f67e4385914bf21990c84e42eaa83787033d5f1985f55983a9
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaA0:bHuHNgHg1flT/Vk3HYwLfU/rbaA0
TLSH
T1E7158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 935KB
SHA256 aa14da3908f347334d5eec3ff5c7a9122d278f2d68aa1ae183f20d4d3fa0c7d1
MD5 6a8f69819d156bc257e772399e7fdc68
SHA1 705d2d9e9ecd7aaf5abff4c49265f16be0e10690
SHA512 371412f8df15d2ef9059b6953ff495f5c08cb4db997e1e05dd9afcda169f577acbca1ee00b325d1ae7273d18ec626f8cda8d7100238ff2a6a44b3b2e570f45f6
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbab70:bHuHNgHg1flT/Vk3HYwLfU/rbabg
TLSH
T1F1158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 935KB
SHA256 48f9e98d3485d546cf4cbfab7ad140a7426ce18e074703105e956b3d955adb0d
MD5 db060897fba0e8adad3bdb472873be79
SHA1 1e50a96b4a8f34baacc1496670bdf2be79cd8445
SHA512 f44062e47eb6f57c58544267d6522bcbccadb950b45293457d30d7307180f1dcf015a3fd4a18a1a882484dca69d5a5485a7e30854efd551b80efad629124491a
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaWr:bHuHNgHg1flT/Vk3HYwLfU/rbaWr
TLSH
T133158C23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 935KB
SHA256 d4b5121427a0b65fc33e09ba83520ae1d23a78518183e2a8af9046884d4fc6dc
MD5 afffa4cecb30b32f12838a7f827ca2eb
SHA1 2137d80c40fb8e7de0a6bdd1e2d39f676f2a14d3
SHA512 51ce6735273f7c8912ff11abbcde232318e7c7a3c5ec6730fc593bc2425452a39c1cd6faa76631e3dd31e615272866ee0ede3ba545a9726cb20c84f8c29e8480
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprba8n:bHuHNgHg1flT/Vk3HYwLfU/rba8n
TLSH
T1AD158C23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 935KB
SHA256 8a76fbe09893b72a90f641ed51414b9bfdf35a6bd3f698e36aa8741c515e5fc5
MD5 f1d69c7d4b9082cc326ccfe98cf04d20
SHA1 48aad479386dbd75f863804f63b5f60d4f8817c1
SHA512 2b21761a9cdacfd6f44d5ff0c4f053d9a70db51d1999e5eecb50ca543e73186f569322e0576f0493af6626c822fcd38edff74d3f189dccb6b5a6ec78768e1188
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprba6x:bHuHNgHg1flT/Vk3HYwLfU/rba6x
TLSH
T1A9158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 935KB
SHA256 71c769ad78bcdb59a45e3740a7e757586f868174d043655cb1d97dc9c63f429e
MD5 75a4712c125be234f79bfa838a455b5a
SHA1 4e4448828262854a9b0d3844b1c0731eeae11355
SHA512 cf7725d2fb4ea3d6c68fb914927a1773b8eebd22f68fd84ce85a879fee5885dbf38123a4b81a621b1e7ee2f7793fb18b4a709389fefadb408147cb7573309baa
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprba8A:bHuHNgHg1flT/Vk3HYwLfU/rba8A
TLSH
T17C158C23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 935KB
SHA256 2aead59afe16c1682b280cc7ecf5f369891fbae261d759804f701e3b9699ed14
MD5 b3cb4cb977d6964808ebe53749b7598c
SHA1 ee4210739782cc0b3f874e084751d756ada4d6e8
SHA512 ab69f9cee792028d82b524ac08cf0cc9e0c2c9c54dc8a7e265a1458d117688c7763976e13fef9c561b2b95c6287249575774ec84dd286dff98b8ad5037a7c19f
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbal9Q:bHuHNgHg1flT/Vk3HYwLfU/rbal9Q
TLSH
T1D5158D23DEA498D2D6A64870DEA68701D775BE610B1193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 935KB
SHA256 021983ef75df48781036e447a2888ec41e869f6d892dc989c5dfd6ef0ce8c091
MD5 b88ec2a0b9815b005f92eb7a67b6126a
SHA1 7bb2406923f915e3af83e194bcf59abdc8c2fbf1
SHA512 8600881c91efffc11ff937bf26d8595149f51c5ad73524df82655ae4391d79a56e792393b7f8ea533e87db2c5b60abe700a7053f9acfb1929add16b1ebb4c244
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaQ4:bHuHNgHg1flT/Vk3HYwLfU/rbaQ4
TLSH
T1D6158D23DEA498D2D6A64870DEA68701D735BD610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 935KB
SHA256 04b260c1b2f789f78ac0b868532fa8b714567b7f64a1b73e30da2546c8039a86
MD5 5978c7ba4506c0a3f313ee23bab25d78
SHA1 b3de6e79c9cbe2caa013109c9a64d025c3195bfc
SHA512 c29360853d62ec3e1b5d43efd59908788cd556248bc4ec6429649e1429e4a7fb9dbb783ea23f0e53731564425388a03b663627c636b736128519843b603983cd
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaTu:bHuHNgHg1flT/Vk3HYwLfU/rbaTu
TLSH
T11E158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 935KB
SHA256 690e7e7dfdcc27e2577c9c212b322c0b12c79614d77a4e84321a19a7c1a78cb9
MD5 4ce42c71ab11ca3921e6c53427be34f5
SHA1 7a9e76257dca5112024c971fe509df2a2b93a43c
SHA512 aefd3298e81ac75ba500f28c550aab0a89f71a975c4c1ee47333e1955c77cfa31996336f91ed321a255ee06a58574088838caf308985635d0e646da5ff659ace
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaOj:bHuHNgHg1flT/Vk3HYwLfU/rbaOj
TLSH
T16E158C23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 935KB
SHA256 77581223d460b3faae7cac0c672491b98b14a65b692394afc16604a835a61c7f
MD5 ef68b93fcd8962d34c5f364e3a585478
SHA1 b666abda61b0fc64ca373bcdd62e0e9850830b10
SHA512 f6867aad2dc772d6b43e40a442918e55a9877c4dcd278556313215679718779fce615a8d9051d25d8dd78b2cb3e3d2a00e5167bfa9373000d83b296dd33f7de3
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprba7g:bHuHNgHg1flT/Vk3HYwLfU/rba7g
TLSH
T120158C23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 935KB
SHA256 31856e5157b07f95bd171029e4d47caf09e349c92a093ebb4e82b49db7f31b1a
MD5 b53f490dbdc57ff36024504c61318cea
SHA1 d018b649117d0bebe11227972c2b1e53f6680227
SHA512 44c0810d913e7119cc2ff136402a515e07ac8f152556d5c3c3ed28bc1471d3c85c6d7a13e06149be20d01075bdfa81ffaf6df49ab6556bedb46494494a4afecd
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbamI:bHuHNgHg1flT/Vk3HYwLfU/rbamI
TLSH
T100158C23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 935KB
SHA256 dee63b31ef342e1e62ae65c87d91d09418ef09c007b5f20aef5e920b6246c6a1
MD5 6f54d73efd4e09f5b8ae889400e9e44e
SHA1 6f62e14c773c158160c5e0d095c4ead30f2d5ea7
SHA512 5672f4d1dd202e6cf7247243970e8d27da6ff8581af6109365609b445e3eebdf543157f72adee6e3449d5da2c52150faff5a1fae7b2ce564457fa8cd1794b693
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaUo:bHuHNgHg1flT/Vk3HYwLfU/rbaUo
TLSH
T1FF158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 935KB
SHA256 c18093b214fe68bed5ab699d1cee844077220c35ca608e502c486d769bc60e67
MD5 826de9bab0607905c237c0f4aed58fdb
SHA1 7674d5ba10b02d6b1b9cb356a1cddb432c92806e
SHA512 97906890637737c9e1d4b3f7ba95aaa731cddbce02362e07f5a89d5a6b073589d062b7502b2a7728781b9102c9a6724b6596cc5e55408a2b4931753b41d27bb2
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprba3+:bHuHNgHg1flT/Vk3HYwLfU/rba3+
TLSH
T140158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 935KB
SHA256 6915844c0b0132e641db9c7faa48529d5b7ea7faa9f7f53da8133b1f0b91959f
MD5 db8921767b32d5bb1ef1a1591ce6ccb7
SHA1 b9e210d32da101f12ae995ba435c73640601b3bb
SHA512 2c416d94ae20e06d47523ec6cdb0c44807efe88fbd8b48585527d2ab21d56cb0c6d00531ce471ba246e6fdca4545ddb8c1422258461753b2a0c73c4304f319f2
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaNQ:bHuHNgHg1flT/Vk3HYwLfU/rbaNQ
TLSH
T1D1158C23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 935KB
SHA256 26a96423df243ac8aa93911aa681eb1e339451f70209b1ccb275358d06f03660
MD5 51e1e7b6e3fcedd1d373544c4a5c2308
SHA1 32a1cfee5b801ce226e3f23bce92670670a7d570
SHA512 6db47a597b0ea852f2709b32bc72de00eac427d2ff66cfa87c84aab70ffbc948ae683dda4464c40440e68ec0f5f5f47ebfb5ecd0ab67de1a6ef4241c717166f6
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaCX:bHuHNgHg1flT/Vk3HYwLfU/rbaCX
TLSH
T1A9158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 935KB
SHA256 10f89c5611a02d46fcf8226d37e2876a576147f1922f7f1b81de370ef2b8fcd7
MD5 72ce97652c7684c5bacebd778bd62497
SHA1 56d541c510ca09467844c4d7a50c5e55f4c77c62
SHA512 61babf54b6a51f47de2acafb1e4355d781dab0136549ddfb2108666d5575e08400f72e50f7cebdbd1aa86a20721b3469e8f08b1c3f7e6a76246c9d3704f3feb8
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbakL:bHuHNgHg1flT/Vk3HYwLfU/rbakL
TLSH
T1A3158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 935KB
SHA256 1015ae34c2c6076c23f67336468d410b393aa5143f736a0125929491b5ef0592
MD5 333a0a8589c71f01c431d6a7953ad90d
SHA1 d3915c1e7cb92a18f0ccd3d27b0682ac6acbcbeb
SHA512 6a422da4e91c3bfa505242a4685d31b7b55f81b44398f86a59fc2629d097d434817e4c1b9a16a0e7ddf9314814ee776fdbca147dd68636de377a4d0a6752b9f6
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbaAFC:bHuHNgHg1flT/Vk3HYwLfU/rbaAM
TLSH
T158158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 935KB
SHA256 1fd384cf9573839a18fa92c58b919f517b4950dd395aa97f534e4e1b187345a6
MD5 cf8c2232f79db0a9dbf15938b485b959
SHA1 9766d0706d09500cdfc231ec1bbf4fcfa4d60a7e
SHA512 8b3d635fdee144cf825a5baecf2692557e801bcecab9e0dd228375dcde371af952c98bf34175225f5bf83dfc683689c7f69d57891bdf80c00e234835414c8e8c
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprbahh:bHuHNgHg1flT/Vk3HYwLfU/rbahh
TLSH
T1E8158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1812-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5720-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5720-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads