4f258b07b938f46416536944fc71cf00b150a9012dbc2d2b8b264173f11befd9

Analysis

max time kernel
96s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 754KB
Sample260731-ws6bbsee98
SHA256 4f258b07b938f46416536944fc71cf00b150a9012dbc2d2b8b264173f11befd9
MD5 5eeaae6a6712a857e86f2b3da6bca1de
SHA1 c6247e8c081139613bc7d8ebab565a92c31bce37
SHA512 1c799220e63d9f44bcfbf1c8483e136099733d1548ab9188a6478906fa820f2d5b2cd0bbc94a7291b50d906fb43e626ad177691d9ebdbb0ef9aafc920de9c0a5
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCo:A3mnXoZjzyacNVOE/ZxUiKiYQFCo
TLSH
T124F49E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/5584-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c557-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c558-10.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5584-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4588-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-477.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-587.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-686.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-730.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1064.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1113.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1357.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c557-5.dat	aspack_v212_v242
behavioral2/files/0x000e00000001c558-10.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-39.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-404.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-477.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-496.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-587.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-686.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-730.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-743.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-953.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1008.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1045.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1064.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1113.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1138.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1169.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1176.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1183.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1221.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1325.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1344.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1357.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1376.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1383.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4588	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5584	2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
4588	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_5eeaae6a6712a857e86f2b3da6bca1de_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5584

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 754KB
SHA256 4f258b07b938f46416536944fc71cf00b150a9012dbc2d2b8b264173f11befd9
MD5 5eeaae6a6712a857e86f2b3da6bca1de
SHA1 c6247e8c081139613bc7d8ebab565a92c31bce37
SHA512 1c799220e63d9f44bcfbf1c8483e136099733d1548ab9188a6478906fa820f2d5b2cd0bbc94a7291b50d906fb43e626ad177691d9ebdbb0ef9aafc920de9c0a5
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCo:A3mnXoZjzyacNVOE/ZxUiKiYQFCo
TLSH
T124F49E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.3MB
SHA256 d6568045406486e673fef06e05ece2d15b1a83e42b8a5fc2a661d78c76d8b5ee
MD5 37b559012de554e3ba8485aae1c2d5e8
SHA1 b3e6cb278c8ca21d97ea54cdfcef0824a12be34f
SHA512 7ec8607cce22b40273009910bfe7e70adbd68400e6ed645df9cb3948ad1122968dc3ab36cff0aac9c77706cc87fe4938a6ec44a3a7182bab1d1dc6ce7b3a8639
SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYQFCw0Le5ji0hmxNrM:A3kMAPji0Aj
TLSH
T1C2557C17FAB446B5E023C1B5C9D2969AEE7134825B30C6CB1359C3283F63BD19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 769KB
SHA256 1ff141171cda7d468e52778b5431e8d0e8d97e0cdd2178b77f2d974fc8cc2721
MD5 f89574a2a0908bcd0e46afd129dfd8cc
SHA1 c21ae75d3c3a2cf15c35843f8dd1db86808ba10e
SHA512 e8f57c0ee8d713f3070fe5b4394ba62d235f0dfee1ea0edf831c7c1f38d936ef1f983f6777d2f92056f9c7666009cbf68ec2c01d73974fabb63b346aa355a526
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCKa:A3mnXoZjzyacNVOE/ZxUiKiYQFCKa
TLSH
T110F4AE13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 778KB
SHA256 0ba128a65a447dd3671c829fe4fbe3040ce9371d23ca3dd1f7545229f445c041
MD5 256d678f24580d8261a1d0c7b66ac7f6
SHA1 5732641a4341ba8263687825cf8caf96b35448a1
SHA512 64df0ec9adc1feb66cd7e5f1253651c288bd9a2699ff42e06382e3f83f2b1b8fdee414acc4f1278cea21453e6366a361e42066478de6e5919ebc3157c09b911b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFC76:A3mnXoZjzyacNVOE/ZxUiKiYQFC76
TLSH
T198059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 778KB
SHA256 74722b89bbbd3ed3fcc1a161327f5d2df142dd2a012a49ecd514e9fe970ee9ab
MD5 983593a308cbe346a921efdb851a640d
SHA1 bb788ece6d55c3f18bd1771a29f018e69fe0de6a
SHA512 391317311240a58171ab3fa18612808d5044a3775ef88b36a28349a97f519732b2b06c91794d2aa644407dae4d987d847d18e957e92823a8b876f7edc7156cde
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFClN:A3mnXoZjzyacNVOE/ZxUiKiYQFClN
TLSH
T1F0059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 778KB
SHA256 4649185b0bf3f0fc91924f0cceb96ed248cd2f7ebf0c8b4e7aadccdc013ffad7
MD5 2ac4f93c29c87fa5292281d6dcb883ed
SHA1 267b3522715d3089ca229a218c698253a7b2da5f
SHA512 193d36a135ccf813da5f2bfe187a1643b6d4d571e02f10630bf964f6397a496129c4be8b9ec1049668b7de8003a5450fe710b6f9be858102ceae532f33c1ee1d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCjf:A3mnXoZjzyacNVOE/ZxUiKiYQFCjf
TLSH
T11C059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 916KB
SHA256 896079d6889d904be0f9d49a7f5ae2aeab0ee066e2d420fc89a2b316e6b37ddd
MD5 93ac2635ad813bfeeb0c0092b8acf4c7
SHA1 ea560f8e5a77cbe15e3b1c3fba54190cf88ad25f
SHA512 40a83ed1c10048cbb931a9e3d12a61074a5241a98a19efcfbb20fbbe81e5b90682b93f2ab8ffcd2f92d3dd617609b0d4d96013055d139d47fe46c92e3a9c4e5e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCPyPz5L87:A3mnXoZjzyacNVOE/ZxUiKiYQFCizy7
TLSH
T1AA15AE13EAA114F9E116823099D50A12FB75BC675B60C2DF236882252F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 778KB
SHA256 6573e641324eb213767e0e6016aab3ce4df5b75a3e3cd208ed14e3b9e5d03726
MD5 31d40d6187b935cf7c9f34ffca3e1fcc
SHA1 22c403ed5341920e7c5986e0163a6567b6882c15
SHA512 dd11984dff44df5160d36a5312122b6d0b8a8d0218db2b2c624531cbfea218ea20dad2579216b1c25d88d1fc1a2fb47112b1b1b0fbdef06fadeeb524b037df4f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFC1o:A3mnXoZjzyacNVOE/ZxUiKiYQFC1o
TLSH
T14E059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 778KB
SHA256 ae57b551c579794fb5da400ed6a2c67cd01e4bd360f007eee96a98370cdf7b94
MD5 377baee493a860d15f0f7d4d5ffc1279
SHA1 f68dfe0af1fdedd40ee3323afe8eb39f3426e416
SHA512 5d813fb8d824cf8f9e3a53ba3aebf3db66ac6dacbd5b1d67504e992de1be326208cf3b05d75b379024bddc1b1e150c69f53fd8d11d9d6c5caaaf6be36cdbe140
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFC1u:A3mnXoZjzyacNVOE/ZxUiKiYQFC1u
TLSH
T152059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 916KB
SHA256 b4584eac3199a4fffaff79ca0c09cef27a8dc414fb13a77c836386e39015f143
MD5 71d8db50554ca7f430eaf3eb52997996
SHA1 c7f834f827ba8d9d147a9b320d097a1808bd3f37
SHA512 df5e66675bed2eba6c1de3ac08bf467d0580228216a6831a98919cf6609ba6ca46953415b1240ffa9e738cf4316f71053a5bf51ee1c1574599fb4b22efaa7217
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCyyPz5L88:A3mnXoZjzyacNVOE/ZxUiKiYQFCvzy8
TLSH
T18415AE13EAA114F9E516823099D50A12FB75BC675B60C2DF236882252F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 778KB
SHA256 e83f3b8b085de787c7ee3b26ccee060b19a6df9a808741dbc8d0e0e2e4f37759
MD5 1eb8ea5aecf52cba4fe7c4c594d15220
SHA1 ef9dbf2b0624cd844d366c708314163bba9c88ae
SHA512 3413e2ef883ef3e43f37c8a9dff77b0373ffd43fd9b29a12bf684ab5805daa26f01ff30ba9fd8706565bfeeb845ab4610a1fb23186b6848c70dee35f16c757e3
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCr9:A3mnXoZjzyacNVOE/ZxUiKiYQFCr9
TLSH
T1BE059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 778KB
SHA256 10a9b0787867d05f91432ba25d1a3b57072f145dcd24d48dc001a777bf96fa8d
MD5 ce656a09e4acd91ea9db3d7ead9fa1a5
SHA1 f018ff02081c7249f4967e2d11b4dbe85c64eb72
SHA512 24ec7fcab146e8344e5bcbba9533140299e107229690ef3504c70a0b6bcc6bc3da398cf0d25c3f5d5475fa2adcce5ad68a65fed57da4a9bf73328b3e227843a7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFC3c:A3mnXoZjzyacNVOE/ZxUiKiYQFC3c
TLSH
T18C059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 778KB
SHA256 0d7ee02bbf0ae2286576931dcfdfccee6ae4ce965523e22965239fcf860b7982
MD5 92f193bcaa281f6cf000378b0771028a
SHA1 c47e8119c270ff1ef7fdb7f929e0b9b3bdfe9e9a
SHA512 bc775f1104a34921f7a3f36bbd2238db39bf1c30f145a943761b07722655c108e17928ce05fda98e7db428185c1bbf99e6c8f38544dacaac8ded9cec496b5bc4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCAp:A3mnXoZjzyacNVOE/ZxUiKiYQFCAp
TLSH
T166059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 778KB
SHA256 3e125b1e7a8c528ed2bbf400e36f12113345c83f7f0005b540d81996fa3c55af
MD5 d1772dde7ad98f9507782759ac1613e5
SHA1 1d34cd98c9fed6242e3fa8725b9302891d7c52b7
SHA512 a660a0144e2eff1b23306dd97315230fe002ef8076c1ae46c691288ce79c893ca1378ac7faa081fc35df6f38b45a81e8f355072b9e95ea7cc1e678537e19da7a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCH0a:A3mnXoZjzyacNVOE/ZxUiKiYQFCHN
TLSH
T13C059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 778KB
SHA256 58df1d63b5e01203a777ae910155dde298a6983b9c8c455b9f8d4e755df92724
MD5 e8d12b1fa8197fcb5b06897bef891529
SHA1 125981ccabf9c41e997225e78ed0fd94898fb8a9
SHA512 aa004abc44b00ab09ece0991209847052542cb1fc8451e21c58b278af5b5ac7dd0aefd9fd9810fa4e3dc5513365174af7ee520148d3ec229deb9b860b27340b7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFClF:A3mnXoZjzyacNVOE/ZxUiKiYQFClF
TLSH
T1E6059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 778KB
SHA256 0c07c1013217a8ebfd34c5ce0ad1158a7a99ee5a6143868ad30afcc58e10a652
MD5 267b2d80506fc8394b19635f489b49a0
SHA1 917dec7069586ebe95502a4e2aba2136b31ee83a
SHA512 fb8a5759bd0edc4cc520362abc73bbf5d24ca7ffabd869179ba5fdc207679bd44c9f87a04260bf267bbeec88f5d5f409dfedc4e6b47d8b5600fe8523efd5739d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCGC:A3mnXoZjzyacNVOE/ZxUiKiYQFCGC
TLSH
T1DA059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 778KB
SHA256 1713071e62285f2441b580369427796aee7db8c9c0374680b9039fc92be88bd7
MD5 4617ade94994286a7a06799dcae294af
SHA1 7e64450c7f88547463ec69aaf9c0d56e01626990
SHA512 2122f08ef9e433f6993901078012fd6fc8cd224468f90442fbfa911c94057e3becc78b3da7281f0c57ae289f28759a9c146a5e464ec526bf19075bb78479546b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCJw:A3mnXoZjzyacNVOE/ZxUiKiYQFCJw
TLSH
T190059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 778KB
SHA256 a511dc61a1eecd23f0bb7d9a9edc72c0ea44698dbf2353dd011b80766146fb7f
MD5 38c8351461edd7cd29f9740ad64dfd4b
SHA1 e15a10ce6ed32f7b02b9d10a0beb46195ea01218
SHA512 7fc31301e221651e0009a92828d1711e494d44a4f8fbaa1c155a66a4db7aa6c02fe58fde26644bd2182dc827b6a7a077be054c246802473b14a6239b9cf113c7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCQT:A3mnXoZjzyacNVOE/ZxUiKiYQFCQT
TLSH
T1F0059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 778KB
SHA256 0cb31944108cba119d85aba48d7673ae0387262ed2166b27cbaf34b63ac8f217
MD5 a7e9c0b56d092b9818e52767b6dd7242
SHA1 64061902e7bb28bf117b60306cca25c56c26ab05
SHA512 af5aa70a69901686d2c03330e476ddc8130622c9d702ac26596d33fd1a592fa1bd28cd56ff362f6b689f41ca340a720ed8321c96b4d796933524c7934dd44b0e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFC8u:A3mnXoZjzyacNVOE/ZxUiKiYQFC8u
TLSH
T12E059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 778KB
SHA256 dee05f07a6854384ec21af5ca0b9d8bb6bf61c37002da08c8d78a6bf678d489f
MD5 cf18b703f068f8f5820bd6ddc70cc7a3
SHA1 24f1b235d157cfbea021637c1208358cc951e22b
SHA512 2d532d61b1f3aee2d6a218d8b4788981df18a03ab27e3135158f9df0834b9b4f34d7486bd89fb1ae7901af66f1e4787a32211326aab893581549440b8c0f3bee
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCab:A3mnXoZjzyacNVOE/ZxUiKiYQFCab
TLSH
T156059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 778KB
SHA256 8c20f04b0b074dc08c9d91487108a9ed0fb7340de4d481693afc8850c38fba19
MD5 d42fa0661da71c4d48aed30b396b5650
SHA1 32a9c549ffd6a86cf4942d86e9c9ced8648cfdd0
SHA512 a278952f3ee823d51bba6100835ceac9da1b1c3bfcd8b268ef2d5a7ea230e58b391372f8363e64d2379e9efee8b0965e12fc6d314e879fcace106ff2a6abc804
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCcf:A3mnXoZjzyacNVOE/ZxUiKiYQFCcf
TLSH
T11B059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 778KB
SHA256 3675b0409cdd9b5107b1383089f8ddded8911cbbf244cea42fe8323b746ad4ba
MD5 4996fb45734ec8a16285242f852e7af8
SHA1 0beefb05e0dfb12796204afea18a76bae1240a12
SHA512 07550b66de01ba6042dcb643ba641fc66f1491b451f3366cdf77aaeca4c05551e6ca212fc9be4c407568847a222a389f53d215b92ccec1db239c0e67a25f2b2f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFC5K:A3mnXoZjzyacNVOE/ZxUiKiYQFC5K
TLSH
T113059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 778KB
SHA256 3133f572ea33b01aebed73ee16a74ab82c730ff6240957641f526985f9f57e6a
MD5 e3f6ada7eef6dfa92648074cf20acebe
SHA1 f67fce0a7c7681647f703bd25cc62811b3e78a6b
SHA512 985404f0e70a2d9863cc4f5811bf7a979d447679346809972646b9eb6557a3b8085147ac2da7ed1d1032eaf822669e839809830825ba7d38efb7e2851189e42f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCik:A3mnXoZjzyacNVOE/ZxUiKiYQFCik
TLSH
T1A1059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 778KB
SHA256 1624eeef3474ab9a96fe48bc366764d249000819a28de79b446fb18e1c7df5e5
MD5 36ccca94014b34722cb0977855bcf4b1
SHA1 512c9635f6914fcf8bd61299a7a588a7344f5197
SHA512 1872c6ba9b92cec0d62f2ff18b1bd162fe0a3615428cb52da54a415edfa0feb0bdc900013fdfd6f3ab00d51778930498416b268ff0b91e6819129759963b9ae9
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFC30:A3mnXoZjzyacNVOE/ZxUiKiYQFC30
TLSH
T149059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 778KB
SHA256 52eaefc6c81ac6881ead300c9527237617274d5085e90a6598415d4844b973e3
MD5 3b9c578d66fdd0ba1ea5c9f73d303baf
SHA1 3a77024df53cf08853641c9424513ba2b199d036
SHA512 afd9b1167389a2bc8cdeb390db10780b7ee660b1853f81ae9dbdb58fb46919de20ba5428d1d51c892919592b64293d89f1c8fdfceac5510b138e27e3921cf46a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCm70:A3mnXoZjzyacNVOE/ZxUiKiYQFCmg
TLSH
T13C059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 778KB
SHA256 8c4e013a52270bff4c08369c29c464273893ac0cecab37df04d55d70699f224b
MD5 d7582212a12663e3dbf199d89d55f23e
SHA1 accc556626d25f3d4684bae49a3d24c0d49620c7
SHA512 737fa5e6e9291740c77cb3ab1f567004d6239da709f733032bf5bb8dfe38813e5d5e9c60ae6256facae031fc3772e943ce257516cc3331953e2756e479796da4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCvr:A3mnXoZjzyacNVOE/ZxUiKiYQFCvr
TLSH
T13A059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 778KB
SHA256 3c0239b008320839d4eebcf13e683df8439103b1ba7912710a125daec9bdd268
MD5 9578b6540d998c616d58dffc2b09e8ff
SHA1 3d0e44f9196c3e5418f39fd5d2df422a89ee512f
SHA512 4c8a2f66c99529864ef6b2192ec37f1f8bc44b4f7651b7bd7fc2c36125d447040aba2a7d16dd7a1af0246d4170a0675285b0c15acbb8d3b0cdcd6045416a2f2a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFC5n:A3mnXoZjzyacNVOE/ZxUiKiYQFC5n
TLSH
T188059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 778KB
SHA256 2fa08b9b619a5597113d8b3af57d9c1f47383e06ac5b772661d3b61b4105c495
MD5 7f5881fc4f4119fc3c7c455ab11a7ef5
SHA1 3292990990062ebb395313f59077294cf361d1fb
SHA512 7a43b8dbfc03a2ba76b14da20cf7acb44320cafd6e5b3ccd6354355628f874a6bcecb37f319bee12581c3e7537f82028e8b26c2bed6a8ca1c45274231cc4c8a1
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCVx:A3mnXoZjzyacNVOE/ZxUiKiYQFCVx
TLSH
T169059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 778KB
SHA256 f8dc339a2b9ddd2272143de7ff088b89be2d706283a12482839b09556cad8efb
MD5 311eb11dfc4292ffe7172b92cd5752e3
SHA1 ee13797a3179272d4ba0b95a0f1979bca989528c
SHA512 506055f2768144facb504ef0c588ce76e4454e41a69ed67b39584be012000b7e32ea59ce6e081439abe966ed82357f292bf160df5a21c80858d9d9d8a4c879f1
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCLA:A3mnXoZjzyacNVOE/ZxUiKiYQFCLA
TLSH
T1EB059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 778KB
SHA256 db88ab15dea23ac344df7bebb3130673b698586fa948297c76ea45cdce951ab0
MD5 5d757f57bda3b9a6bfad219fa54694e7
SHA1 796584339db93d84ac1b58241fdca971e634214b
SHA512 343dbcbbdff6ba7189d7a37a0434092168687b12d4df0c237da7fb16026fc441d87328c8a91b2d01d9b4609939d9f4a16866ec454448bb43eeec895c6b684bb8
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCc9Q:A3mnXoZjzyacNVOE/ZxUiKiYQFCc9Q
TLSH
T1DC059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 778KB
SHA256 74f3bf9c6fb459fdad6baa73977ed3e70ce705211053e1c6ca3434d2b1bf93a3
MD5 b33d9b335a0fd5d05c815a6efcab9944
SHA1 5f3cef4e3a5652c266017013abe4d49f9388e153
SHA512 4d956276bccf8a3c92e68013e7b6380889454bbf63e87167984258cd8ac1c23a6b7ea89484d6c1d4a215808a26f193459ef0cb1528aaa12afa19834f5e197bde
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCF4:A3mnXoZjzyacNVOE/ZxUiKiYQFCF4
TLSH
T1B6059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 778KB
SHA256 ad8a7c66908060f9f170f862f65518998430a7ae6bc6d3deeab15087bd1ad315
MD5 b86d8c07dce9ef3cbfe1709c935a4dab
SHA1 bc3d0b8f0ef557bdd7170f717d529b745df1fdf7
SHA512 cea93fdba854a083a3653552b2301b73c902052ec8eca8d3a10109b665cee7492b5612a56b71e062262985730142d7cc9020a9ee7d23903b16db4cd92a6e3cdd
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCQu:A3mnXoZjzyacNVOE/ZxUiKiYQFCQu
TLSH
T1D9059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 778KB
SHA256 25453c9649d42bc07b49b86ca94db59d87a52919d92abe92e2aa8f621e03c9bb
MD5 5588704e9158714ef5ab7f8092875ccd
SHA1 f1ebdfe5c2d358f7ac430a02db354727aaa969a7
SHA512 64cca65c50bedd0e133ec261a21c61de29cf20d1408f8fc3c4c586cf60110b7bc16aba2e40d0884ceca3f51f897a2b1fa83218d2f9323b7c514c2b45b85932f7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCRj:A3mnXoZjzyacNVOE/ZxUiKiYQFCRj
TLSH
T1AC059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 778KB
SHA256 befdc54a9de29efdc64c55410367182d6deca00bae9bde8d09b52a608324e55e
MD5 89917c4c06af2946216a289798869c16
SHA1 23ba3af83e8a4f31636c4e691c8ce7d5953937ec
SHA512 537b26307f2c9ee2b2d6b21f19961371051dc098d5ab4037deace3c1c3fb57b33a1cd66e6265a37e3a8ffb2ae58f9db8d7e8fc61ccf1821ae0fcb9e22cd62d49
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFC4g:A3mnXoZjzyacNVOE/ZxUiKiYQFC4g
TLSH
T13D059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 778KB
SHA256 ae9110512f7d6921438a68da29f8888b62c76b311cae14a51f5dbedac7a78917
MD5 9e27f6215cca9e2eacd40146efcebef4
SHA1 a876856c375c538753c3fc32a5df4122c922a4f7
SHA512 1f42104a094f13cd031c06c075f52b820df3ed5d10df6baad037cb1fa86f47529b65b472b1c8e1647019613ff29670ec20551fb27de9a2d16efb0e5ec1674125
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCXI:A3mnXoZjzyacNVOE/ZxUiKiYQFCXI
TLSH
T121059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 778KB
SHA256 094613f79ffcbb38ee1824dedb03cfe815d7c4efc007d786f57f55213e5804f9
MD5 34ad8d2e05e0bc297d240f8039bd2a0f
SHA1 5f09d196f3bf1f5889d6c8257b5b1dc612b8eec6
SHA512 0f1b6d04fc7226ea18ab6766cc73a08f7ad38b08a36ec9001e8df03c01f9043677a8e49f39ceb1dec08981db1be5c814dcce4298211c8842abb6b2c754d0d34b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCdo:A3mnXoZjzyacNVOE/ZxUiKiYQFCdo
TLSH
T1E8059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 778KB
SHA256 f794702c11de40b51792a530f8b782b63fd805eb6140923e96faefd453624041
MD5 c4e123228ce3a8bb21e542c633d13dd1
SHA1 b25e0e8ac4d7bd51a10c99a215556e6142b17ed9
SHA512 55413d065d48d0b75c2f3f32e15ca4973a843e9febc63fa244faee41067449182d7be256e384031a96631a1253a06a333e158b8b87543a76002e3cbb708be553
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCO+:A3mnXoZjzyacNVOE/ZxUiKiYQFCO+
TLSH
T14A059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 778KB
SHA256 9954ebe2effd8b57444b4e4d29214ff5de5baf357fe7258d109cc4ae0b92c4cd
MD5 c444ac6d3f14b8bf935f7f8a38c90c44
SHA1 fb2bdca52766d9cd5f25428b1baeb9802aee8c20
SHA512 d873d96320eb316d1de1daa9260484ff359a02caef448371c15b34a3a3007f945e0d54a5017110d2ec0b6ac3041250b6b71b22c8044226d519f23d7ed70e0ad2
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCOQ:A3mnXoZjzyacNVOE/ZxUiKiYQFCOQ
TLSH
T1F2059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 778KB
SHA256 0cc295e064ec2b8bd6025fc588f088a7139579e30c5ae45f8152328acb92c988
MD5 bb283de70e4d7daf0594608dc54d704d
SHA1 5119f824dc7285df2e0ff5d1fb101b3caff6da42
SHA512 f044bbea91af6196db7bc22d992a19d2341876cfc1b485211b847ab2108f17e7ffc3aa15f28d0340b258e0f21232980ea006fea4a6d8f98189d77427f8eeb318
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCvX:A3mnXoZjzyacNVOE/ZxUiKiYQFCvX
TLSH
T14C059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 974KB
SHA256 39932ed46ee3df1e4ceb2006c84bd0c121650ac8d8672bcd54b92e5f16aee7da
MD5 d5409db69640eb69e712bbbb90ba2bc1
SHA1 4e39a5a5ba7735d5c68ff4ab6bc7fa1fff5f46ac
SHA512 98fc5dc472dec6530d91d587e78705bfa85141859a059230fe76779b262155ee14ada6acb85d18743ca2b77265292dfa6318550579b8ba6b06fc33f64ec09681
SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYQFCUjCXF7IwZ:A3kM8C17IwZ
TLSH
T12325AE13DAA008E6E5168174A9D64626EBB5BD6617A083CF635CC2212F137C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 778KB
SHA256 52b26f5c9afa6e4d32eecccbc97652bffba137a2433e3c5958b42303330f75b7
MD5 a27f4c846f50a2caef6ce927065d5a34
SHA1 6c4a6619fabe9ec7304993140f3650a8dd61fee9
SHA512 e3d5b2588c5ff0c8ef48a9c20296ce0c4f1f6f4991924d7fb11781434501982b11423dd6e3daf8d59fd4b0ab62ac7011fa6de5a1d1893a764467d688142723af
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFClL:A3mnXoZjzyacNVOE/ZxUiKiYQFClL
TLSH
T178059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 778KB
SHA256 a8af99018d30a7a6fc57a9ed0a840b5c3995b028cc518bf161227eeb400a123d
MD5 d76c70a4d87cd3d39e428a452ae20dc3
SHA1 64c11c1354c451b429955d20efd6add694bcd5fc
SHA512 104451269e8548fe40a163c77784fcc1512ccbd5ae972866ddeac29379a9ad30776011f5e8338e1377b8e7279df0c3dcfe6eed853afec01be5287503d75dcd5b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCDFC:A3mnXoZjzyacNVOE/ZxUiKiYQFCDM
TLSH
T179059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 778KB
SHA256 5fd90b9b9d655c3fa36b212ff939b46df14b98594c7bdb779a231da0ce83ad31
MD5 bbe711f4ce88fa324adbe10fe76f56d8
SHA1 faaaec6bd9742cce180964169679d8a6514860cf
SHA512 10d314db35088723896d6ff6304179053453705e0ceee55d7e8e1620240453442fcc79ff849492169901f8ccf2e0eb53e764f2c269b94ca08b0fd6c6b516ac8a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQFCEh:A3mnXoZjzyacNVOE/ZxUiKiYQFCEh
TLSH
T137059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4588-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5584-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5584-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads