0751197507b4a0e4839765dbb9b6f4b9f53beec6a2dffa1f112ca60055811ca7

Analysis

max time kernel
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
Size 946KB
Sample260731-sdvphavflg
SHA256 0751197507b4a0e4839765dbb9b6f4b9f53beec6a2dffa1f112ca60055811ca7
MD5 0af5634ee87d92275fd511ba96483a12
SHA1 4f0421b478998c17ae32ea23a9ae6afe2d1f63d0
SHA512 861f4c556f64f99388f7f299c4627b278c1e297241c7b8130db128ed7ff70b6ce49abdf6913364b758bc54baab9b656416e2db82039a84f4d715c9e5b1df5379
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzF:J/sCv7iUIxc3EEg+QLb8NVPhPzF
TLSH
T10325391366948F71D56F053059A94261DA3BFC295F2087DF16ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4380-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001000000001c4ff-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a3d-255.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ba-346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-462.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-571.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-602.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-718.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-780.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-787.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-818.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-849.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-945.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-994.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1037.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1044.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1100.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1131.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1162.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1255.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1316.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1335.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1360.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4380-1419-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1928-1426-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00080000000188f6-1469.dat	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
1928	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4380	2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
1928	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_0af5634ee87d92275fd511ba96483a12_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4380

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 946KB
SHA256 0751197507b4a0e4839765dbb9b6f4b9f53beec6a2dffa1f112ca60055811ca7
MD5 0af5634ee87d92275fd511ba96483a12
SHA1 4f0421b478998c17ae32ea23a9ae6afe2d1f63d0
SHA512 861f4c556f64f99388f7f299c4627b278c1e297241c7b8130db128ed7ff70b6ce49abdf6913364b758bc54baab9b656416e2db82039a84f4d715c9e5b1df5379
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzF:J/sCv7iUIxc3EEg+QLb8NVPhPzF
TLSH
T10325391366948F71D56F053059A94261DA3BFC295F2087DF16ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32Info.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
Size 975KB
SHA256 eefcd8c813c45f33dbf99f78419d6028f58d21a6d8c4b394ff2d780003db6d09
MD5 d0c14bbac7d8d0206dafd052a1e82328
SHA1 199f418abe197894cc05ccc46d42ec2aa5bf8e31
SHA512 c6dda33de5e1fe22e2920c1a059dcb351c5b55034ac504ad34ef6c0a666618f7162f0a03af20e7d98106544beb8b5b95602ae2939b360df8fa6054950cdceb37
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzTP:J/sCv7iUIxc3EEg+QLb8NVPhPzTP
TLSH
T12B254A1366948F71D56F053059A84261DA3BFC255F2087DF26ACAF297E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 4efe85200b9ccc45ef88fcc4a6090a98c2f7cbcfe031fe07d9aab590a28069bd
MD5 cb6581c18ac4b5f757b56e928da8162e
SHA1 4ee8b155e2f7fd38b481d5dbff8bcab3f58cee9a
SHA512 060c4064032873cd6ff4ef8ede668bc7680e0fa9a33c888bbc42c06826a6212cecb8b2b42da5e3f05c98a0bb9080f3a6938e0370591fefc5dd14fc0bb155b7df
SSDEEP 24576:J/sCv7iUIxc3EEg+QLb8NVPhPzB0Le5ji0hmxNrM:NG3n+C8NVHPji0Aj
TLSH
T1F4655B17B6A48B71D07B8074C5E59656EA337C150F3087CB12A9AF283E327E1A939737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 961KB
SHA256 8412d443bd6ddd55ad7de3d150c700d34754ddd958c2a35f346c3bb6e76ba155
MD5 e89c2d066be2cd7a1f2ee897ba5dad2d
SHA1 af8e5e4a7650e8958fed5f8dd3fcd6b178156f10
SHA512 66879c4e35ad8ef4b5968d2a9d65ec8f714a6aac7b287c2abd4ff639d0489c085fb071dc2b2c11080a0db2b41ef6824cc03e6d83852dd99b1d49229a0380f7a0
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzDa:J/sCv7iUIxc3EEg+QLb8NVPhPzDa
TLSH
T19B25391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 970KB
SHA256 254608cc71e236ef904fb01ae3f6837842e0a6e26d8387ced2ed1264853cd14b
MD5 f235966d196bb8c7214b775f0e6ef4d3
SHA1 6535fc3f8dd862d0f1e3533b56b02f4e02c9a3a6
SHA512 9426217c24df679e2e843a018252f094a3ad42b01997e6c2a2cf382f6cfd25d3dbc0e8599a8c8e8dd7ef576d2656ea7aeeb4cc85424b09a42fe8d9c09e382639
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzi6:J/sCv7iUIxc3EEg+QLb8NVPhPzi6
TLSH
T10C253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 970KB
SHA256 012c184f6b20861bcb771b4c583c48ffbf9cccc35855bf3b4b76b749349524b4
MD5 8ced0996ac88efbcf6a9a21a6965cc19
SHA1 d1477d0d6ed510be7c1e2fa0479b1534036cf7f6
SHA512 b43cb497ad4eb4f0fc33732761e5630a27365d406ae306a084ef56aff9dcf2214ab58fec15184cdb53d1d66844fbddc25fd0193fade1b047697b9daa5edd6005
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPz6N:J/sCv7iUIxc3EEg+QLb8NVPhPz6N
TLSH
T1EC253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 970KB
SHA256 edeb3328f0288bb0721ab364a9a7e929949b3130de2dd3cefacfc92f993bebe8
MD5 08b158880479c685c336c35fffa91a4d
SHA1 a2a93f6cdd87174b038601148fb2ef0ef16f491a
SHA512 3937fe198cd9f6aaab7e71cd311f2ef2c12d0d026eb7f2dd2bc841d7905a4892e6ec986b1e6a0aa73663b5ddc8d5bff8a4707dcac8da5b37c90fe1bf52fd0946
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzgf:J/sCv7iUIxc3EEg+QLb8NVPhPzgf
TLSH
T153253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 970KB
SHA256 4083271ab402ff4acc90cd8cf69afbc4fe2a86f4a91fec3d7457d660d0477e99
MD5 e82fe3ee462519a85ef8590c3490b07b
SHA1 7f881b8036dd5ca4e8c5f096e2b177d714e2b2f3
SHA512 034250cc68f707242b15a8adb06ec5214d7a2e5fd262855d6868b8bed9fcaefea5c46c3199e3e9b933e2610a147c100ea323dacad07116f48b4a4c4318984e2e
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPz6o:J/sCv7iUIxc3EEg+QLb8NVPhPz6o
TLSH
T199253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 970KB
SHA256 dc727144542cd209415a2d2fd78ac961815f42d45b2f86195a68d5aa923d6d66
MD5 a64ff9c1e3a066da2a204725eb941d28
SHA1 6db31529fe0e72bf0f6540d10523c15a3bddd82f
SHA512 3ead57e06eca62b5958a4ad3167ae1dc331eef0751d549173ad919c30c2c267e97348026a038f473c1270dfb1be964de5b4718fe557ee51845800dcb2409d0e4
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzOu:J/sCv7iUIxc3EEg+QLb8NVPhPzOu
TLSH
T146253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 970KB
SHA256 bd878f800ca1c8458d051a23a0e1e490064aeddf62ce957f1ef75ebce321a606
MD5 e68264e0cf71f68e36d22d6794034c23
SHA1 a992be631cf0a70632ac952bca6fecb95d719be8
SHA512 20f03bfbc664df98d13eeb4f6c09f999ac08e2173af706fad0dad675605a1242b6e63b7d5c46990b6eb61391f8ffa067fae0eef82b86c32f524b7b6a8a2820dd
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzC9:J/sCv7iUIxc3EEg+QLb8NVPhPzC9
TLSH
T1CA253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 970KB
SHA256 bc9f3ba61b0a6a8e6e7e06facee5b7f2d1f83d665ca82a04c7d068bb2d7b7cab
MD5 8f1635c7b4c0d912c9be73e1a80737b0
SHA1 3e1ffb75827018a1e601bd27076ec17c03961ddf
SHA512 191ff49db04ba00d948693c89e2ab196064894929767a966ccd94e8f7d1560d800067c9d99e622e9064bf3c05190a9a7bc7f1f393abebbadda16b5b8c0dede7c
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzCc:J/sCv7iUIxc3EEg+QLb8NVPhPzCc
TLSH
T11B253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 970KB
SHA256 a3e3441b1079575b9d761f0b03027e9703d4f90349c3463902c498f2ce902afa
MD5 3a9269306644ade15327075ec44c7077
SHA1 ec36cce3700c4b17c6486864e22cea9c134d277b
SHA512 213b46fac70e04e4ad8b02cd42b03286e6e62b09e4e5f1d14a67208e3caac6bcbc69a0c809084cde91323c46cc96d7c68a442ad0b23c305ea2943fdb45ac3c08
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzLp:J/sCv7iUIxc3EEg+QLb8NVPhPzLp
TLSH
T13B253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 970KB
SHA256 ec10491f834990fe09adcdd019be6bde5e665a794c32816154cb19fdf95bb1db
MD5 d75237fe4862a176c94979ec8491a250
SHA1 64033688d21dcc09ee6316421e7118f3a2234552
SHA512 342eb2f45b5162f51c5ef34c44a842daf8cdea21d10df6d535c43cbe8a6d6cc63b042c44f8cb28e43775ae0ac8fde426da262d404dde31da2b63b66922e576c8
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzc0a:J/sCv7iUIxc3EEg+QLb8NVPhPzcN
TLSH
T1B0253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 970KB
SHA256 1c8f321ba23c861b1e7077a4ed9ad7dc64d31b4ef01f16c49fc6c1146894e9bd
MD5 13d558d4450f332bbe89aee03963f637
SHA1 cdd27b52fb33c2c1041bbb9b228a2d8167e8e486
SHA512 fce1746169048438fcfd4bbeee3d6f547c69cf0a785899cc4c00687dcc7ebdecc30858f2668bb71201d8ac95cb4d6ecaa86ad334afdcbe813da32c79e8e30b0f
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzEF:J/sCv7iUIxc3EEg+QLb8NVPhPzEF
TLSH
T146253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 970KB
SHA256 e40db0d7c9f457efe398ed91ea0053c6262dabc65bf57969c398a5ffadfc88dc
MD5 6c7cbedbc853fd37b0f9897e54797e64
SHA1 5ae5892be8910445242398b3d09ca673d6e5c288
SHA512 859d182074bc53b2d8c2f9e86911c7bffc1362106ab3c6eff9ddf740f2e1f7252bbd687318eb0037c1d55c325e0a149f7c6850f71f3b05d7ecba8349b2525ab6
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzhC:J/sCv7iUIxc3EEg+QLb8NVPhPzhC
TLSH
T192253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 970KB
SHA256 24ed71de55982ca162e3761387bb5f90fe04b605d6d4dede9afaec2b88607245
MD5 be4a37e7e8d12bdfa90ed986670065a8
SHA1 f18c116fa42e80829083dc96d48a36d592adaefc
SHA512 6e6653babac03a88eb6ae97f2eda4994d62609a8ff5d764b032e52da7440e84d90761c95d8e3b24c77edc06ae5e67706159ab53f78611fe26f022bf26e001859
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPziw:J/sCv7iUIxc3EEg+QLb8NVPhPziw
TLSH
T1A7253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 970KB
SHA256 c2648c97b557af44a328239b418f2e60cf4c75c46a59ac6ae70301877879077c
MD5 fc70accd221549d3539bce17b2bc47bd
SHA1 2bfd9438161735a22f84d6bd5fcb76ee5a5e37f3
SHA512 83f150d28d780da233f3beb4546cf8cd483e683f798d7bdbc082ceee726a86c1a0507db319121ce98a2a5e5db7be39842fd1b85853f233b4ab96e84c069eaf03
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzpT:J/sCv7iUIxc3EEg+QLb8NVPhPzpT
TLSH
T1F5253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 970KB
SHA256 bcbec81c701782a7a9a37d8db759ad4509748b6aadfc6bc5d39b7293fe45dbc4
MD5 7aefbbcf1f27784dfb154dfd698200b9
SHA1 93abe3779448093b0496ac32367bb29976c98796
SHA512 df58784e8250b7aabd55380be57e7794b35adb64cfc4d073f89f74db31438fdf0779bf3a53d0dd2a23a775b09e145738dc12e5dda40c9d441095ecd86038943c
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzHu:J/sCv7iUIxc3EEg+QLb8NVPhPzHu
TLSH
T163253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 970KB
SHA256 51075fa0a6aa9d0f919e639332b756d91fed7a3e433b45f9665ebd280bc0194f
MD5 646abbe1e4361d3557f137e9777a9144
SHA1 07ddc320b9ccfc04637b3c35cbeec6b0b984749a
SHA512 2fbde3adf10c5c8c7051b4bd0146f89436f0e5f4df99323e82b8c3d10908af14470066aacee88f3397a0fca25faffbc760e1af16ef0f2535b748f8ba800f2241
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzbb:J/sCv7iUIxc3EEg+QLb8NVPhPzbb
TLSH
T1B8253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 970KB
SHA256 77cfd46ebc35af197b180eb51bcb3311befd4fbc004bfa41c45c54793ad25858
MD5 78b3c98c34a14514cb58612440f3d132
SHA1 b984fbd25bba6f595aaa343856a363a2b3d9bae3
SHA512 56a02ae8ea78ab684122bfa6114fe256a8f5a0314170e9ba8561ad6445e1d8ff759ab430dab889879d8216755d098c4a40f62743fcc4568c4333d62f1764d744
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzvf:J/sCv7iUIxc3EEg+QLb8NVPhPzvf
TLSH
T16B253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 970KB
SHA256 c3ef845eead9de5451454d1da5f562c720b933c55536d47b87486a2a800144d7
MD5 4d7ba95b7a6d762b5af468c50bd0c1d5
SHA1 544648eca89648a63cb81f01ed7f83cb9b90453f
SHA512 8877a607df692649cb37f7c23f8f92761d029c28bad17dd8403639a7b38ea1c049fc17b0c91c09774b3a9a65b55e6b3a4b4d7f2776b50c67ba30e216a5fa7f0d
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPz4K:J/sCv7iUIxc3EEg+QLb8NVPhPz4K
TLSH
T100253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 970KB
SHA256 442e8cd4c894c8dc0944323261c1fb577614bc8431b670ca1f894e2612528195
MD5 8f166f1c9d5f04b31f4913b9147b904f
SHA1 115e43ede8ddaf0528ca020d58974e4b89b276d6
SHA512 9d27dadfc38e30f507dcce2c12db693e2452016c2e49547a389844b7750b212665eac9d56e916c2834dbfd1bf03a0304c0046bc3297f391528bb60e151e0c5e6
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzlk:J/sCv7iUIxc3EEg+QLb8NVPhPzlk
TLSH
T14C253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 970KB
SHA256 b085c4ce8aa82e9f1ca4483fc3fac11071cdf773d1abb5cd6f427e7b0d3f49a5
MD5 b4317794c985ce4f5e92856b7f5b7794
SHA1 8afca00b92d9a09a8eeba7fa8f375188b23fa44d
SHA512 62bc15715e3f4ee438f474ffd7200db9ba49cac82e118819333c1b2f7b79c0323b857569f786bf50fdde31035ca6523b2c1487f155d86611ed682bacd9383de7
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPz60:J/sCv7iUIxc3EEg+QLb8NVPhPz60
TLSH
T12B253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 970KB
SHA256 ff85f7dd133104d92be95f3e9eac3aba1b966e21f163c5523e994452968e2440
MD5 c7d3cae8683feb6a6b9e26c4478ce69f
SHA1 d6fbc53b33cb6f6947308a5dc6164fa9711a3ad9
SHA512 e4cea24e0d4a65b5a8fda7cb7c4d37ee127313b0727c2b7f2e9f836157b2c27ea79f7a8b8594ee2b7d22bf34b9484ab636d7da3851be99d39bdadc3e5c6932a5
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzp70:J/sCv7iUIxc3EEg+QLb8NVPhPzpg
TLSH
T1D5253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 970KB
SHA256 7ecd1ca379655629efe9795edddb630d6cfde0a903bb4a3a02e7e49e3cf0bec2
MD5 b4a027c453fa0ebcd1488d82fb79cd05
SHA1 044b2c0a0568ebd1531e64081093ae5d2d30beb5
SHA512 56a3e770cb2fe5ea4b01b6c2dcfd7f2cd2d8fd3a319825f8e332b29e0de62a2066f033784dfd47346b9fe979040181fb8c3dbedd25c4e046e78d6ef19587690a
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzQr:J/sCv7iUIxc3EEg+QLb8NVPhPzQr
TLSH
T13E253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 970KB
SHA256 78e19b3bd3c3c101ea4f49f6862f924fd1af44c3c6549cbb26ebb7947b343583
MD5 5c94bd99f0510d73bb355be3033a5f6b
SHA1 fed4bd2e1aa122d3641a9019f6626a71cf969f7c
SHA512 1cddb6062a2c2be8b7002b5c6283be328882f4e5042f419eae89c0ec13d3716673ff9ffb6c04807a6c4a04ededd2cfe18f9b934aa2051c442de8996c0022f0f4
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzOn:J/sCv7iUIxc3EEg+QLb8NVPhPzOn
TLSH
T103253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 970KB
SHA256 d5225f29434282fbd45520eb2f696b9490551b39bbbb70df9fffe86ac0b3b229
MD5 843b57f89c2f3a7f0371d7d2d6a21199
SHA1 1841f30b11f529b658cb684ec9e00620844aff73
SHA512 8b63e4aafcefee3daec126222ef0fba6580b945d9f3091a48118833c146bee8073b947f80eed0ecf323215bacc855b693cd26dc74eacdd028866a1fc8b369cf6
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzEx:J/sCv7iUIxc3EEg+QLb8NVPhPzEx
TLSH
T1C1253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 970KB
SHA256 7f6771e3cfe5e0dd6320bfec074d23a3835b97b3d2b529026e5544e09426cdd3
MD5 73c37e228663e89e59d46b0977667281
SHA1 71429994698a4b6b5c46b9dc6173a92a935e0f08
SHA512 b7fa6d08c0c54a8776de6f8d96967601b57b2abc5c64942f530bee893414f99ba79761f08775e2fea4bfad0e840cd1d035eef3b9bbd4eb78d0f0e9f2d316777c
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzOA:J/sCv7iUIxc3EEg+QLb8NVPhPzOA
TLSH
T1C6253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 970KB
SHA256 81866d990b45d9fd8602c599bf5b4d4aa79eeb89efb7dc95fb3b23aea852cc23
MD5 da0293b6daeeff59f7303237f5aec9a5
SHA1 740906f3c9dcff85d8c4b6e6850bec34bd900690
SHA512 ceb06a33ede995c272ac43c99ffe8e949a81623908501ca5b3cbc0f7ce53c5eca374c5909ca660ffc5bea918d3e16b608fe5ce92529d03d528f5cd05ba58215c
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzH9Q:J/sCv7iUIxc3EEg+QLb8NVPhPzH9Q
TLSH
T1C3253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 970KB
SHA256 bb354074f1c383b1e33aee77f34f73b0133652b08a65c87df7bd31f19d86d590
MD5 1b5b4484a452fe94134de80df4f93202
SHA1 e418ac3e60aa3222e35773b97b8ae9c3c541d010
SHA512 da169a74e275988b59405b23ec60b8f7cae71673a69f88c9dc3028bbcfe37c936c890ca479797e81f0230ee37cdc5176887aacaf7a2e678f3f9d33f2659d9b04
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzO4:J/sCv7iUIxc3EEg+QLb8NVPhPzO4
TLSH
T19D253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 970KB
SHA256 61358105648619f519f337bd53eebe254a13e30ed9e0bd543dd5da795bb4d387
MD5 64d6605bc66ed9a6a6d68de9a6308ee2
SHA1 22b8c896b286ceba2d6c61ad288703a19cf44d50
SHA512 4dd4aadab9968ef90746c8a3ae7c1abc160eeef3c8ca0eabd54b7367d79e8188b5ec1023d04ae571080f4c50669ad8ffe01b94f11517825a97af4b78645ff87c
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPztu:J/sCv7iUIxc3EEg+QLb8NVPhPztu
TLSH
T137253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 970KB
SHA256 ab82cdd4d8bc75af42ebccb23e349e8bfd3c7ca66c0a49d5636ce73fb627267d
MD5 0182565d4d46000b45f722c9957403d1
SHA1 f640802cdb206803d8cb17697e71979f7258e82e
SHA512 66a75f15a18ba1ba1b21c7c2587a7fa610d1f747eca7d64f9f86808c3a9daad4e12c2263cc44e5c22ec62fda0c0978cb4735314bda4d29bb0909b2da1f575678
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzgj:J/sCv7iUIxc3EEg+QLb8NVPhPzgj
TLSH
T1ED253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 970KB
SHA256 47a8b38dbe48cf470b3e79f495e2ea556bac7b19e63287d876b9e2d1f27e2262
MD5 885cfa052de6f938d80f7dcd8a609c5f
SHA1 cfe1061a03870a7ef6e10785bf5180268005295f
SHA512 597155f08d843d3ccb4b90fa036bdf94ba04a61f22fbde7ffcba125705d461530fd072966588d6ab72ff619479e1bd471d2a94ed3118526df6eb0b3b281624e2
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzRg:J/sCv7iUIxc3EEg+QLb8NVPhPzRg
TLSH
T198253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 970KB
SHA256 49f7ee5d82609aa4b52cd6dfde49474dd22e0a37f0fe0aeedcd6da587c406755
MD5 a1906372b1acf990cac1762423e496f8
SHA1 86aadd841991d81519058ccd10fbc8cb83b73235
SHA512 443d93a29b4fe13abac991fef49509847dfa93a69474c94137035f5b347c50eb662fd4361a7a0715edd0ffb9fef5fb77a4a1283a113dc16b3a91fcee88a15212
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzII:J/sCv7iUIxc3EEg+QLb8NVPhPzII
TLSH
T1C5253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 970KB
SHA256 6acba7eb47e35f76547f98bbeee62b3586bc7c347a7d36fd58617edb59350781
MD5 b87b7c956c8af01e29df1c925208f1b0
SHA1 e8f2f0bb0ffe318e5c185b6bac73f9963d789a6b
SHA512 f9c36d37521866af248ec26b74a2009ddab901c50aae58dd1895e5b08a51dc4d37eeac6df2bc16cc2252e62bda84c9b6e659b6723fe3f5d7b9a88d3c07193317
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzqo:J/sCv7iUIxc3EEg+QLb8NVPhPzqo
TLSH
T11A253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 970KB
SHA256 3fe41422d822bed262300f93f488b473fd553f08a61b9ea24869e30388fbb0ba
MD5 5faa54d1970341b18f423cc31aa76363
SHA1 b43931968af120e8f7a36c4f559b994265904a2b
SHA512 76b02eb402a211c90c83dab64a80015698cb8d9d8034740e972aef57286f08bbf1d305a60cc4032298ad1b71ee483f5bf78dd3272ef4524e9ed15f99e54b827d
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzB+:J/sCv7iUIxc3EEg+QLb8NVPhPzB+
TLSH
T1F7253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 970KB
SHA256 7904f702fd5db1b2ab01963beeb3fbdf59a37a8f0f8fa2e5eab65ae5f757d877
MD5 708d54af70491ad251b06b5f99cee63a
SHA1 5b1f41748b09a20d55cd02ed6485a0bbc0b7ad05
SHA512 a79e3e2b0b3a5a1e78eb764566a066d4afa818c348d511348e498c6a6a64f82973642169a10e0170c6eab97953af7c0fc34a6e0d07c46fcf6097bfb161bbd991
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzPQ:J/sCv7iUIxc3EEg+QLb8NVPhPzPQ
TLSH
T1C1253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 970KB
SHA256 8bc76d61b3473ed42bb1f03f08147ea2b3b15e94306b47f9ac89ec5b464aad82
MD5 457837ccbc95022cf5069fb9a78b40f5
SHA1 201c7272f55515e77e26c362fb2581f118776079
SHA512 2eedc5d00d06f144c09a2da084cf38c6f156ee7dc6db3c060091476fa73b8ab645a5ae40f946e520e952c070f6028c910ebbadbec0f95a8844da5586cb22dddc
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzUX:J/sCv7iUIxc3EEg+QLb8NVPhPzUX
TLSH
T1A2253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 970KB
SHA256 5be0feaf4fee7ef10f8a45de23b37ccaa71f657a7e9f01abe0b0ef7e99ce8e38
MD5 72313442cf39f84c97beb420f76b9317
SHA1 eaff2ba8f3fa8a34331ad624810797247e99a5f8
SHA512 c50d0db58fdecc9a71770f403111ad31584fa28a58e2c02bb5f1efe4b672aca743cb162d18e730ec30e0af644730e1e4e00bb8b6b8cde1ba46543651a0f56e26
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzyL:J/sCv7iUIxc3EEg+QLb8NVPhPzyL
TLSH
T1D5253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 970KB
SHA256 425060b0198609fd0955d9e7a6a8b30f2bc336545e2251fcbf5c9e8ea01acc70
MD5 557ebd6ec5662e92b63912ab68534add
SHA1 66d48d78727d8172b5dc18d9504adbe87e8d3cd3
SHA512 426f18247de2afa4034c71ff84e6ab0a63f2f223081785664987aeab4990bea8454dd02f7ff4414d815628739c7d56898d7d870afb98dd03e602ae6f5a45b7cc
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzWFC:J/sCv7iUIxc3EEg+QLb8NVPhPzWM
TLSH
T147253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 970KB
SHA256 b6ac3de2aeb1cfca6562f75c2ff7420955a3882ee9c3e5bda07e7cd0e52065eb
MD5 98d1c1b0f55a62ccb7fdb76c02a5cec5
SHA1 45ee4eda9ccf8de5b485350eca293d4824da75ec
SHA512 470090be8fd12a123a90a01b4346364fd6ae49058e177d2fcea0a9e98eee40d3c925ac1c6fd747f0c8c4d76b3a113e75bb71f9eb63ee87c198c4165689cd39eb
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPzfh:J/sCv7iUIxc3EEg+QLb8NVPhPzfh
TLSH
T147253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1928-1426-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4380-1419-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4380-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads