673441e373fde260a1dc32a287c9cd97485575e8427c8d6bafef3817400cc2bb

Analysis

max time kernel
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Size 949KB
Sample260715-rgexsahs8v
SHA256 673441e373fde260a1dc32a287c9cd97485575e8427c8d6bafef3817400cc2bb
MD5 7bedefb985416f216701b9d59fc03146
SHA1 78ebe7b9ce9d0ed76a789b07a884698882812f70
SHA512 1250a3b722391ad36e8c96b65006fdb14328da21ca4f8a4f2fc86a323704abb8908c4e988f0b3c694265204229c5609a98a69ed74185fff148e5772c2e126a68
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2c:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2c
TLSH
T145257C23DEA458E2D6B648709EA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3684-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4a9-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3684-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2536-34-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018992-201.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a6c-208.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-233.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-246.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-253.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-481.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-506.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-609.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-634.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-750.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-800.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-850.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-914.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-939.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-958.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1087.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1157.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1189.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1298.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1360.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1405.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c4a9-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x0004000000018992-201.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a6c-208.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-233.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-246.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-253.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-260.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-324.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-481.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-506.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-609.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-634.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-750.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-800.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-850.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-901.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-914.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-939.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-958.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1007.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1050.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1087.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1138.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1157.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1182.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1189.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1298.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1341.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1360.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1379.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1386.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1404.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1405.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2536	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3684	2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
2536	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_7bedefb985416f216701b9d59fc03146_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3684

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 949KB
SHA256 673441e373fde260a1dc32a287c9cd97485575e8427c8d6bafef3817400cc2bb
MD5 7bedefb985416f216701b9d59fc03146
SHA1 78ebe7b9ce9d0ed76a789b07a884698882812f70
SHA512 1250a3b722391ad36e8c96b65006fdb14328da21ca4f8a4f2fc86a323704abb8908c4e988f0b3c694265204229c5609a98a69ed74185fff148e5772c2e126a68
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2c:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2c
TLSH
T145257C23DEA458E2D6B648709EA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 42d48b04ac0a102a270f469d7a913808c04346e002c8441071dc491ebe4d67a0
MD5 31fff97a945486df4f5949b8d84adbe6
SHA1 afe8648bdb785aff2679ab5be1f6b5bb962f4bc6
SHA512 d60a68b9403e6afbb057093e6b9ae6e957a1db492d49b536052b6d80e34074af9642f63331eff31e9c8d7721ecb06f455fde85d295dc3e1c3180aa218ff37d25
SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2k0Le5ji0hmxNrM:T2agnTkLfUCPji0Aj
TLSH
T125656C26FA7486A2D0B3C4B4C9D2974AEA717D510B3086CB9294F32D6E337D19E36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 973KB
SHA256 5d081b60e4c7349feaae596e41a96ab6bbc62cff7615761e425f3403e5101340
MD5 e894dcc1201119d92044f135891ace79
SHA1 304e867550e7aca2c39e0db8ad0bb176ded4f2f8
SHA512 e6bac284d9967560af6c7f935d93e8cac5c20f48b5eac1dfab9aab3724173a576435bab490bc59f8bc9230520710667e6e0867e526c05a3411eec30fae900749
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2QZ:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2QZ
TLSH
T1C1258D23DEA458E2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 973KB
SHA256 f72d62be2407bf6865d8f6a92e29c19cdcc980ee5b7a2f31fd7079cf119e74d0
MD5 de4f89d955702a08abb678d4efed9fce
SHA1 3b5c1cd89789e3c1dd38696b1a3ba564fb79ac46
SHA512 c6be4a093d9225fd41a21dbcea8c90a1ec497996e2c6a4c39ec55024962e754b88c5b11fcc6046ad94905b7d418b2d90b7eab95b68ddf25af014f36141505d61
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB231:bHuHNgHg1flT/Vk3HYwLfUwaoEaB231
TLSH
T179258D23DEA458E2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 973KB
SHA256 4e22ecbe3d5c57bf7405dead0cfb620a89fa5b29874580efbb08ed92964616b7
MD5 a860e08d253e33cdbe25d58c8b6c4698
SHA1 f3307cb623742bd19c17a9fbe3d90e2ad26e6d1e
SHA512 e4f17131e32a44c2340eca7939c5815d92378caa5fca2d17562b754e5b89618a1af12195289665c7e101b709f385a0305e8ba74c392ac32fa3b16dd87a601dfa
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2v6:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2v6
TLSH
T157257D23DEA458E2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 973KB
SHA256 788298ea462afcbc9a187f13583d87d9089fbd9589006e4d3cbefc8af1fe8cc2
MD5 66d8fe9301385a636068797b1ace4b78
SHA1 700bd81a6b0439bf28e497f928e88f39bde2f85b
SHA512 4e646329f0d5e5f6f8c6af5d4079dce814f54ebf64c507d5ac308c720e89c3e5eaf092e16cd826a9264e62576af832718f0d71dd186e8653089a4ca681a7c655
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2xN:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2xN
TLSH
T1D0258D23DEA458E2D6A64870DEA68701D775BE610B1193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 973KB
SHA256 410a47a66e2588ee278c4dca9580db33169002fd9769b0a4ae54df96bebfcd4a
MD5 eebc18bd02145ce62d17677ad9577c43
SHA1 63f01387321d703d952d29f89a23d4ec7a08b35c
SHA512 c6f80ec02f04382b81ff7e6ce529b860ab0115a17aad6c51edc8a9a2bdefa3dea5ccef808431a088dd2fb531ccbd07f62b32063c4a94b040d9ad11acf563e0d6
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2nf:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2nf
TLSH
T1C5258D23DEA458E2D6A64870DEA68701D775BE610B1193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 973KB
SHA256 75a6119c15517f24a8f1ba39f32ecea800a1ac2301780e462d642aed0d347db6
MD5 2b094b44d003f2cd6285453dd434e716
SHA1 12916f3cd0e981cbd933f3d62dacc9d8f0385f8b
SHA512 11134d5e86564819e85a567773d98f390da16f4092607a9b71e94a7b0837314d797583b69bb948f29640ccdfe9455b6e9c109e61ee2e2bcd923635d9d75c4390
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2po:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2po
TLSH
T1E1258D23DEA458E2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 973KB
SHA256 ae59eb6886a5a4fb2e081a0ae0efd69b886f071406c0b16d8a9ef6fd6ade855a
MD5 ffddb6196ebb76c9b6dda22b40f2fb4a
SHA1 193839b4bd06e404000934bdd03906c87bef2dc6
SHA512 67280493f28f6f430564e83b596b0c0d4981ceef8d07cbbb7b1d9dd065671477a8c5e06ff7ed2f3beedf40f36401ad5366691e2c7f0a7188dc43855988565af3
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2Zu:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2Zu
TLSH
T1B3258D23DEA458E2D6A64870DEA68701D775BE610B1193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 973KB
SHA256 094e007d63ffccd4f23ed8b7759609bd5a2593d05bd09152e588ed0d3e4b74d3
MD5 2b2baab9a3e9080ed737df14d347105a
SHA1 d84cc3c1ddd2d78f6e6f54321b12ef7c9f204702
SHA512 0258092e5a2afe38a1070fa317b3e1daa18ff16d96d7573a658ad565ae5295ebcdc917839a60a888e3c7ea1100d3573ac0a957d1748c241bc1ea76f320e1f3e9
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2/9:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2/9
TLSH
T1FE258D23DEA458E2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 973KB
SHA256 9fb37e891a716bae53c1d6f16f0b4ce09d41a3f441d4f68127b461fdcb3ea20d
MD5 cfef77f7aa23e233ae9e07714ccd6546
SHA1 3e57fb71ea134a5ba14f5b7337c19c50f976695d
SHA512 66c121a7518d88bb0e4017eee8f5da8f2bd356f470fef6429af0c9b0afbc5d2d19f58f6cbfe844a4f7244b7c08684feb14e0ce856afd0bb560730061069c8174
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2bc:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2bc
TLSH
T123258D23DEA458E2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 973KB
SHA256 30cc4bd8117899fabbaf6e4c120fc91cbba0f2ac8deecc19e3d867d02c8d49a7
MD5 b40449731f77d5960994b175d14ebde1
SHA1 065e80dda481144a163c5148fce557c8f9b06711
SHA512 012be94eb25fed92824a97f4e1ca797cf9dbbaad7d92048a8d929de3f3032543a3da68176ba3f42af27a03b70fd6af0115f10f66347889a22871934b9ef4ba76
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2Ep:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2Ep
TLSH
T15D258D23DEA458E2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 973KB
SHA256 519749647e4e9087198e94a85769cb034a867eb6eccdb5e1a90ce80bdca2d4f4
MD5 01b33de025b206a1bd4ff00e43557a91
SHA1 03a3bd1646528b794408c394df965d3773d579c8
SHA512 8f97b25b328bdca89155fd2f346edc3943a4842409c6fe39acd232838b3baddfb268b436ca8d8058e49a591af5711fc233549006fc3a9e7339119e3b71471e6b
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2L0a:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2LN
TLSH
T1D0258D23DEA458E2D6A64870DEA68701D775BD610B1193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 973KB
SHA256 697327cff8a420dc4fee75485d31bfe773961dd2e43366896579d6ba379709ff
MD5 433e8294f19fdc17472b79c083eeffbb
SHA1 dbf421fb6ec9b0e561658821594fcc702031e957
SHA512 5b08f8f0d8cd69d2081593aa51aff49e7b154a1080482b7f8ffe809204ef3bc467b9aa5938ad983795425262c7a77484e7c380443f65ff2f00bd5d30d2bc96d3
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2ZF:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2ZF
TLSH
T12E258D23DEA458E2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 973KB
SHA256 83cb58f8bb21e85bcae2dd4791110849547787af74bb8087e9ff8856c355ba4e
MD5 fa47bb4e1c264fe723f99f143a3435a5
SHA1 5531ccd64c1bc493a708ed1f9a7c8bbbc0290fd4
SHA512 ff78b89ef20478b72eedcd65a31b582b1a43cccec5cbeb5ee9378a131b26ff98de38eeecd4246c0e42a4b2739a88e95362c89b0edf00adbabc5ab5103e32bc4c
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2yC:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2yC
TLSH
T170258D23DEA458E2D6A64870DEA68701D775BE610B1193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 973KB
SHA256 12f9ccbabbcf4fd792401e07940ce64f2fb3f0f6e6575ac671c482f1e5e9a9ec
MD5 3c7962b9c5114cb66e5f5cc3972a6b85
SHA1 68fab6089380fc3680e11df8455ba894715bffc4
SHA512 bb0f8ce7d89606bfd48dfbc887a8f737a684c97db2c6c6582c1d486e567c75a5b85f6cf6aadd2dfcea565cbd8beddc0260b305addb405a491acb0af78c7c63c7
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2tw:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2tw
TLSH
T124258D23DEA458E2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 973KB
SHA256 ab01b4ad52cc34f23e99c50d22f36e3ca983ac3864c90ce3467e30f67f7ec9c3
MD5 9ef2c04ebb3aa1caa8107e95a678f592
SHA1 2c473e976785bccf2ceca89d77f68fbbd5927750
SHA512 4966ff4b3dacda833e1f4a507a65669ea1bba152f3d3a5f3d5db39309ecd5fb90472f80a280f413597d30d71f08bb2a1da59c5f0712d1140aab8b860755506f5
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2cT:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2cT
TLSH
T133258D23DEA458E2D6A64870DEA68701D775BE610B1193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 973KB
SHA256 8d555ee729d95e1a94a84b00a26893ed5315cb90033099f908b65dad9f6168d1
MD5 296d088174f6ec0b9a0dd82c083cc69b
SHA1 67d846b24e21601570d2618199da015700e64c1f
SHA512 a2cbb17b10afd693abaaf9db5cf8cadaa3f95b94a1976d513ecbf395a28438559f240fefd27e25217d0c78cc48e57cd56ad44730ef1c8eba79965677f00cfc04
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2wu:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2wu
TLSH
T105258D23DEA458E2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 973KB
SHA256 df298dbf648d753f8a35a7e9113a24d44a00931f92370f95af78da71553abed6
MD5 09abef5c919ccee0b8cff4b2caca3d8b
SHA1 b7950d1a79d47ff96d19d0e0c002f1e2c2421862
SHA512 15d5d1b34671c16bc91e839651b253eb9246a65ccde9d751592286c49a287dc8da75885126ab142ddfa40e0e70193b57886f9f5473f30d5e2db29e9df067cc5d
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2Ob:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2Ob
TLSH
T123258D23DEA458E2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 973KB
SHA256 d06d284d614a6bd6bd6103879521480ed154a697078c7330211cde8dbb02a34d
MD5 59cb8be97fdca903fbb233b21beaf261
SHA1 e9638b79e880ce43a1b280a2506ec4041d830e51
SHA512 92a7b1f398579a31be181c80ce11ff0b11bb6080c2d401060bd37eb0bfdf3008a5e533b36ae23d8cabbe19de0c019191ead1e1f196e2aa02c49b3867b73191ee
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB24f:bHuHNgHg1flT/Vk3HYwLfUwaoEaB24f
TLSH
T158258D23DEA458E2D6A64870DEA68701D775BE610B1193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 973KB
SHA256 9e8983935d0c20946df7de5bcbde2c828d85c6c48d8b40b33590af0ede6cde39
MD5 b6a7384dc47d77865b7b8a815d7fcf01
SHA1 7a7627589fae5736ce1e43266869a8b4b622e40d
SHA512 88bf4c249f30a455ef0281b72699f345ff84968d3635dee530a3e3f314bf12804ebc9c338707c8711c1f2d21f5a16dfc6c514bacbb230ca5a687283bab018084
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB21K:bHuHNgHg1flT/Vk3HYwLfUwaoEaB21K
TLSH
T128258D23DEA458E2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 973KB
SHA256 7b4ec0e4d97855b58ec1964811e332854ab2c9c587838482b143f86232fb40af
MD5 44b0c9adb1595543abe0df43815469a2
SHA1 fae3461ce616e942eac3a6762794e6138d02ab1e
SHA512 1ce2f8afceeed60b5fc6aac588888e1785c0158b1d018dc32331034aed2bfbd43342ad4f400d87bb95fbc13adf175260344aaa544dc564da6a9a48cab2012ea5
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB22k:bHuHNgHg1flT/Vk3HYwLfUwaoEaB22k
TLSH
T116258D23DEA458E2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 973KB
SHA256 9666b2ba8e897f97e755d3277a12494962545b37d89706580c38907659a00ce7
MD5 42cc18afc8fd7de8267bea42359d2c88
SHA1 fa8e5983a10faabf87c306b9ba0839f07edbe4bd
SHA512 845af69c1a389cea21ccc03574ad0f9c4686b5b2b2b442ee43a6dcf3efb63ec0f524ba0fa66f75bbf83177d47e34cf5273094f62c22a6acc4cc0e149e4b5203c
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2T0:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2T0
TLSH
T103258D23DEA458E2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 973KB
SHA256 1cafe773c4c3d09d054af019c1140188ec8c34ad6494fd58059590eebb314560
MD5 60f156224f4b3bf96ef17947695cf9ca
SHA1 7614fed02923ed9500a138c3c4ccc5cf342cf056
SHA512 5b8809dc04218f08e93077413cbfb6f34930eb3eee282aa08db68c8f31025a0b96e694d629dfa27ae97017295dde06c8189ed4b3d087b7a562da89ad4507ca1c
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2i70:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2ig
TLSH
T1F8258D23DEA458E2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 973KB
SHA256 16c2f513f17b1416e3783d25047bcfef93ea731478b911f8a76fad04ac552f35
MD5 8ef61275a64a725194e0d9ae5a62ddc0
SHA1 6c211b8d84b8b3793e7db1d93a18cac903d75c08
SHA512 923409823c8eed7dcfdefcbc37ce49bc503228f5d07f3bbf70846a4317cde47648ba2c8e28bebb32bbcabc90a577aeb050696f3805b7fccec4425dd36209624b
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2Dr:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2Dr
TLSH
T1D3258D23DEA458E2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 973KB
SHA256 3455ef51572e7a5081e725303b6c4d0f3b9ef79c0d871067ef3a47b9b645cf26
MD5 c07f6f8c17d37b230364fc073cc4d56d
SHA1 9df2b67d238d56698876b212a74ce3cbe4dbfd6a
SHA512 237246434592ead2d55bfa40426d65db275d736f8bc2e2ffdf79e3c6315b6aa9ff4c33d88a5de2b2abe89a0212fd03f6e6ab79208d159c3cec2fdb8078bebf9c
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2ln:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2ln
TLSH
T112258D23DEA458E2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 973KB
SHA256 58599151cc60fce09866c1186b326706d109f9f1e3b601534793626efc32f454
MD5 a7271120b5e12a2a6ab3f7c86ae7ec8c
SHA1 4d101b39aca890416bacab4f51a1a0cdc8a9200a
SHA512 c4f455e65e9bf7a16f8fc6a8d7ecf415f51b821906bd555cffaefb4f5c71056bb3c958ff1056729f67f4dd9a0c9e1cd23cd31019233db5f85e27c822bf42c652
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2Rx:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2Rx
TLSH
T131258D23DEA458E2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 973KB
SHA256 d96a9c728f32306e70fba6684da788fe6205f484d6cfbdd11686137d7a7463e0
MD5 a81e09d8ffd03dfed396abc789422da1
SHA1 533fef5aba58487d48355e97304d0e0b462e239b
SHA512 bda708895e92ca5fc0d4d4be86af0ca1b7450d1bdf12f4ad5f4b369edd9dcc4160a911bca981513b03c18eac3f9e9ec9d409faec4d794607da9d2d1a74c217e7
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2/A:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2/A
TLSH
T192258D23DEA458E2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 973KB
SHA256 a2b8dd9790a1b71f2d47fee8336da161893070f3782382072f87d13ac98a0857
MD5 0ba939843a2574919cd96a5ea274ff17
SHA1 6c238153e77d468b40e142d94f868f1bfdd0e7c3
SHA512 dc4da7ce86f83d3185303f53e605601cc1bb36283854b74e7e43a379be2e20de7af24436173b9d37e950cf9eb695a86bac3df998637bf83f12936e0dc0ab3ce0
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2Q9Q:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2Q9Q
TLSH
T1F4258D23DEA458E2D6A64870DEA68701D775BE610B1193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 973KB
SHA256 7185b95e198aa7285f1339ae4adebb167c59093c86201374cd654c5d6a738b95
MD5 c21e086c0309ea6ab180285eeaa55241
SHA1 44ed67bb01faa08d7ab5bfb041191fd878b0ecd1
SHA512 2899f334accbe4b6abfd3d308be385513475ba6a44cd9aab124d36f58e97c6d13efc25c5d997ffa5b2d404eedc8d07cb687831a106b04383de9ec479d41e19a4
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2x4:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2x4
TLSH
T175258D23DEA458E2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 973KB
SHA256 1f4961f8dc0612c54a6320ed39250e3b816bc5319686967aec9b319319527542
MD5 e0e4d5c580b18470e5bdd60c147e96e6
SHA1 7f16878378674655d743df670b8264138e3f6c01
SHA512 a4dba37472b8f18a09e8fde36aa43f3639fd024185763082f8a94de79d6119c9db266d4c29baa3e1de250b5e146b0aa04d8113716978d087944631196ca86323
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB20u:bHuHNgHg1flT/Vk3HYwLfUwaoEaB20u
TLSH
T151258D23DEA458E2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 973KB
SHA256 945b97839e259db3d0ceaf03eaf9417312e05389e8f965d0eb99ee03b44c5134
MD5 ea1c0765ea8a381fc662d9e0acb3b0fa
SHA1 7434a61cb152197451692846eb317b8e1bf6e6d4
SHA512 2dce95be28b2f966f69bd6071d52fc869202046cac35013154fdd60a3f96adb398bdef1a2d1a60298c6fb68c3c38994970a9180cc6ca76977d89bf9dd5e960cf
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2Fj:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2Fj
TLSH
T12F258D23DEA458E2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 973KB
SHA256 dcdbda6a8ab870a3d5c351b4485b84a198be412815370218bba20aa701c79b6f
MD5 a9c452b8ccdfbf9760ec76bbee9324c0
SHA1 2592f1e95078fb3da2fb3203b4279abc476720d9
SHA512 9c69485c7367cc5c10d998fbc9df9cb3a5e836e7cf7a960ff4fbf65f51315ae09a857d5bbd3863989f8d51781bd0ed6a7633c08fe67c0133100b22cead99bf09
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2Mg:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2Mg
TLSH
T10F258D23DEA458E2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 973KB
SHA256 ecd155d3ba5c822bc1771acea31e9db4c0bdcd2aec2101d0f1123f11d9f9084a
MD5 56520e38cda3909934e4673e71866ad7
SHA1 4c4b4f052550be14f1bdda83982d75c29088712f
SHA512 39839636177a3e3216d68863a291e52106f645c36c52b3ee13000dc46606629733af208239a092a9c15fdcb80f7ee1e7dc8af5d8345546ccb016b050472146cc
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2TI:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2TI
TLSH
T1C2258D23DEA458E2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 973KB
SHA256 47d0ae1a9e2f74b78ab264f38e48a9873f7477b772abcdcf298e6470a8d5f06f
MD5 e4e622530b69002c9350fd7f73e8e9e1
SHA1 59f780091000e870b87d055deef617775bc804fa
SHA512 496683cf272e88331c888d0216f2e690f261b7a9378e21d8f52a7e118e854f3e2d985eaaaf5ea8fe28fb4541442c18e685abd3cb894d0c1847239f774fffacf9
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2po:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2po
TLSH
T186258D23DEA458E2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 973KB
SHA256 a4edb4756947d07517e69d3dce0472466f19476ce12e4e37ac1df1ebb123b6d7
MD5 b94b696f728fe653d3fb366dbae170a7
SHA1 8e481d417f288110faa936a49b8100a940d2b9f2
SHA512 c5b68b0bbfefacde0940d55022fa32458c9c1a641160e01e01d1dc2a62e5860d78daa859b9aa2c743c61ec441b55208e29c8ece86f1fb8987938cdbda67cd75d
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2a+:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2a+
TLSH
T1E9258D23DEA458E2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 973KB
SHA256 ca263584850b9c3c930c0fe9bb25565bed16a9d8865d98479bdc9c973188bbd1
MD5 8d9b61dc6ec1dc01bb5f617ba4e02aa6
SHA1 64e682513ad9bf44353ad35fc005a4fa09e5c7f8
SHA512 fb3eef79ad64ddda5636e255e093b083a8661c4301d693824cda05abfd49241d6b5006ecf2af5784e07602e2f076273cb7eb106d99d8593bd6903dd6693c092f
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2aQ:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2aQ
TLSH
T1A0258D23DEA458E2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 973KB
SHA256 b6082fa22e087c4380abfc99a8dd0a578fc6133f9dd744a5636eb5e77eb803b3
MD5 aedbf63dd8fbbd84f25d5a576ac8fb1d
SHA1 4b70ef33a0b26068c1947b565ce5cb3d4088479d
SHA512 349caca60778b9bcf061281446444f16a2183294344a8bf44d298d31390021fd2ce9e65052beb357b50f67ed2c4cc148e1791c81780839d83726834a477eb6b1
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2rX:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2rX
TLSH
T135258D23DEA458E2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 973KB
SHA256 92a66d301bdd84153e5682ace207a13d50721d0c8866082e36b2eae566f4cc8e
MD5 c45fcb881771512e8e1fbe051b6cab20
SHA1 7381de57cadeeb5a48e9428535a5e4f8cc7c390a
SHA512 7a2bc282a8ea087e9f994a1784df1261058cf4afffd627f00f0cac01cc2c6a24e6111a1cc230ef9803e4d65f3bf0642379d09ec48e2dc7ab14c005048cdd420f
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB25L:bHuHNgHg1flT/Vk3HYwLfUwaoEaB25L
TLSH
T1D8258D23DEA458E2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 973KB
SHA256 50c14fbce84e01074f1dafcca608adfa8a432ad78bfd4ea0ac6cafdf790e56a3
MD5 c472448850eac5e1ca2eb96eb6d59d46
SHA1 970fcffd6f4be71fe9b81e9411a6091e25c93a30
SHA512 7e08153f341ce431a2ed39cd8b864160d678d93c7abdfe8aab757ad8dfd5205faabdad5186ecd6c07a74c58e3e3513e0d3a9029805d85c4c4a9fc27e824fc6d7
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2nFC:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2nM
TLSH
T1B6258D23DEA458E2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 973KB
SHA256 b4cc3193f5fa0e95f588d3b209bb480c733fdd6184228ea21b9f4d38178e3e19
MD5 9feaa1ef5218b5f7ad82f82a0f1c65f1
SHA1 c6b7717ce941bc0456dbffa5cf03ce8f53e3fca1
SHA512 7edd3f5e169217b0c0e07a6bc7f30d648532378fa28b0bae416fb3dd139c90a53ea94a9d26b73e0b37fa26cbf533e8c68a96e99d169498b184cadc2d1c31eb10
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOaoEaB2Qh:bHuHNgHg1flT/Vk3HYwLfUwaoEaB2Qh
TLSH
T1E7258D23DEA458E2D6A64870DEA68701D775BD610B1193DFD2A4B31E9E333D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2536-34-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3684-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3684-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads