6d88b936577ad83ee53050c6e807dcf312996585ecc3563c29d1c6a7da39f8a9[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
6d88b936577ad83ee53050c6e807dcf312996585ecc3563c29d1c6a7da39f8a9.bin
Size 24.2MB
Sample260808-ebblysbe84
SHA256 6d88b936577ad83ee53050c6e807dcf312996585ecc3563c29d1c6a7da39f8a9
MD5 e29cf124f918a7a8b9833222a890e75a
SHA1 1ef4e66bbe6d79dbf687d078f53552bd04b409e2
SHA512 f6ae187d9a78e0a7036484a9451e42667a2348d09f4257c799ef9428d6859974e24efbb8012dcb0ccd0dc7a0ee1d4d939a01c58f2d28c205d5c41ec404db2d42
SSDEEP 196608:WgpVhXb+Ium1SkRuTnHgUk19f29G7VIRdjFDQE8CdRW:WgXhXEmAkMTnA/ffBVIjaE82W
TLSH
T134479CD2B38817E9D056D7399605A232D2B2F8124772D2CB4BFEF6191E77AD04B3A740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
6d88b936577ad83ee53050c6e807dcf312996585ecc3563c29d1c6a7da39f8a9.bin

File Explorer

6d88b936577ad83ee53050c6e807dcf312996585ecc3563c29d1c6a7da39f8a9.bin

.exe 24.2MB

6d88b936577ad83ee53050c6e807dcf312996585ecc3563c29d1c6a7da39f8a9.bin

IMPHASH 1b382c703e8dad00285539abb287642a
SHA256 6d88b936577ad83ee53050c6e807dcf312996585ecc3563c29d1c6a7da39f8a9
MD5 e29cf124f918a7a8b9833222a890e75a
SHA1 1ef4e66bbe6d79dbf687d078f53552bd04b409e2
SHA512 f6ae187d9a78e0a7036484a9451e42667a2348d09f4257c799ef9428d6859974e24efbb8012dcb0ccd0dc7a0ee1d4d939a01c58f2d28c205d5c41ec404db2d42
SSDEEP 196608:WgpVhXb+Ium1SkRuTnHgUk19f29G7VIRdjFDQE8CdRW:WgXhXEmAkMTnA/ffBVIjaE82W
TLSH
T134479CD2B38817E9D056D7399605A232D2B2F8124772D2CB4BFEF6191E77AD04B3A740
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

02:94:24:6b:22:1d:8b:ba:8f:46:b1:31:21:67:5a:b3:aa:13:f9:a7:40:bc:37:ad:9e:88:d5:b6:9b:46:70:a3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

Chains

Mar 2, 2026

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

Serial Number

07:60:2c:bf:6e:75:79:40:03:82:56:f0:ad:87:5e:d6

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 14, 2023 - Feb 13, 2033

Subject

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

Serial Number

08:3e:a1:38:84:bd:ff:ce:8e:5d:9d:5c:ad:2e:fb:de

Issuer

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 26, 2025 - Aug 25, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

java.exe.pdb

jli

JLI_Launch JLI_MemAlloc JLI_CmdToArgs JLI_GetStdArgc JLI_GetStdArgs JLI_MemFree JLI_InitArgProcessing

kernel32

GetCurrentProcessId SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry GetModuleHandleW GetCommandLineW WideCharToMultiByte QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext

vcruntime140

__current_exception __current_exception_context memset memcpy __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __acrt_iob_func _set_fmode __p__commode

api-ms-win-crt-runtime-l1-1-0

perror _register_onexit_function exit __p___argc __p___argv _seh_filter_exe terminate _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _exit _initialize_onexit_table _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _crt_atexit

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

6d88b936577ad83ee53050c6e807dcf312996585ecc3563c29d1c6a7da39f8a9.bin

PE Signature issue

jli

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic