fe8770a5e1327a423ebe249ee2af312e01c64dd3e57534de2366e5035193bddd

Analysis

max time kernel
113s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 883KB
Sample260809-pskaja1vat
SHA256 fe8770a5e1327a423ebe249ee2af312e01c64dd3e57534de2366e5035193bddd
MD5 5b302ac45a77ee014bda7682133fcd2a
SHA1 f796f8e06001b5e076c493ee760d62091e6f2fd6
SHA512 74e8ff383b05335712f945e641de09dbb13ebe5458c3c90dc2dec9c94e2e99a67783c3cc4186325b4a5fa0bea09dd77c6c313c37bd08d52a4bb50f3bc3e107ee
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb51:A3mnXoZjzyacNVOI/tTWaLl3z0zDb51
TLSH
T13115AE17F79014F9D8178138C9A54A22EBB1BC661760C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/5396-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c54d-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5396-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4232-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb5-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-433.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-526.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-796.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1024.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1055.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1110.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1406.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c54d-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb5-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-220.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-263.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-433.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-526.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-605.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-630.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-727.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-746.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-796.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-846.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-871.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-890.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-897.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-910.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-929.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-954.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-980.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1024.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1055.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1110.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1141.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1178.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1185.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1222.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1327.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1346.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1385.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1405.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1406.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4232	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5396	2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
4232	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b302ac45a77ee014bda7682133fcd2a_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5396

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 883KB
SHA256 fe8770a5e1327a423ebe249ee2af312e01c64dd3e57534de2366e5035193bddd
MD5 5b302ac45a77ee014bda7682133fcd2a
SHA1 f796f8e06001b5e076c493ee760d62091e6f2fd6
SHA512 74e8ff383b05335712f945e641de09dbb13ebe5458c3c90dc2dec9c94e2e99a67783c3cc4186325b4a5fa0bea09dd77c6c313c37bd08d52a4bb50f3bc3e107ee
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb51:A3mnXoZjzyacNVOI/tTWaLl3z0zDb51
TLSH
T13115AE17F79014F9D8178138C9A54A22EBB1BC661760C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 4d9926db134735e4143fe71775bcad8125e4a0c9414f3244406fe278167f600e
MD5 0ac6d8a62ffc24b2f99156dcdcaa0af5
SHA1 432f42e55bc5c4734fc5f8060536ee0bc4bddf93
SHA512 3fe23619ee26a4ad959549984e05c3bd1935b79432b65646d3e40de8c998a6471e90ebb2c63f5321c7321f09adf208d2f73e999e74f7d0989dde4a48554e17cd
SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5x0Le5ji0hmxNrM:A3kMeT1Llj2Pji0Aj
TLSH
T13A658D16F6A446B5D033C079C9D29A5AEA7238421730CACF1399D7292F337E19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 898KB
SHA256 70d9a03d636084e8532dce718b7929ec585c4f8e6bb294faa79834f65fca5a28
MD5 bc3024f96f0cc042df469f499acfc97c
SHA1 2f0872803971f7ba9c471a173f5a3fa18a98b1f9
SHA512 500a7982b7ba0a42703ba67c82dbb58298337ea22b4d1997d57bd16d62f0be388754769e045b66604df06e01a2aa036e481eed534184ad09b8ddc799ab771c9c
SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5Ta:A3kMeT1Llj
TLSH
T18515AF17E79014F9E8178138C9A54A12FBB1BC661760C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 931KB
SHA256 79091e6006cc06dff110ad8df5f6c007ce5735dd5ebcf0eb9418084864a2f483
MD5 358cfa9dfbba60fbb3d38be17a274f25
SHA1 963f95f742bccc0084aa3b3bc10e5040aef63f50
SHA512 3a6f74250a78f98deb3f27e3a9f816077096a69f9e6abeee185517c8ef71fd1ca98f7849a8b8324730daae05e177ba9e71fe519aaab2fad204ff42c9e381c716
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5Ab:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5Ab
TLSH
T11815AE17F79004F9E8178234C9A54A12EBB1BC661760C6DF136892262F737D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 907KB
SHA256 ccdbd1b26717479551349853b061453a219ac8c8e6b7c67d61a7b59e0c31d681
MD5 b5deaf46d80b0c22e53a971e21417bf8
SHA1 974c1941eeb16d078572261920fcf9e8058d439b
SHA512 c49efa26c9135fde87e8566a109c72441307a6c59a2c330d0d8d9932e1a40de50d4fd8d94331903f0774c6088e9051cf0b421e8fa26801641d62430298f0c8c8
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5S6:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5S6
TLSH
T1BF15BF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 907KB
SHA256 1ce2844cbd59b555ff6fdf5ba7c45ad0c68616d749195b0e1ccde5127006c753
MD5 dae012ccbe7307c09c77c1aa2eae817a
SHA1 adee5ed344469238f65db6ab8ac488fbb9181068
SHA512 e949a0467912c78fa9a73396040312b821c323d48f9fd4df4abf2ac6fcfdb6bbdfdc85956468af8f3a35ebcded622fbd9b1753493727289f59caedeb0cea9f23
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5KN:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5KN
TLSH
T14E15AF17E79014F9E8178138C9A54A16FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 907KB
SHA256 15a4bd8d4f0ca832e6dcc79e730aaea932d1b68cd1faba64e797d6db954b6892
MD5 bfb0003893cd63e05713708ed03bb09b
SHA1 6eae16fe097c7b20d36d8fccb490f157ab3e919c
SHA512 c1879410c06756d2bb825298cbb85f85aa273a2d456d7a3a783093ad08f18c0ea50829b79eb156dc637b5a76dcf3fff9479c66ff16d95b801b04363d90083b38
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5wf:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5wf
TLSH
T18215AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 907KB
SHA256 55c2e5c38ed215e5780f9120e50ef99b9b47fb67773a69a7af1346d8e03fcc88
MD5 9a18942acfea1cb3f490e399f9e866ed
SHA1 296846bfb02b3768b9458cf02bf97cce6dd4aeb2
SHA512 b485b44071941bbf3d6453bf7f7ee2a5f9ab9ccb9086d82a39441f36ef5fc847994ab3ba46edbfd8d36ea683b19b69a3cadab9b34a65e16f8963b9557310bbde
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5Ko:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5Ko
TLSH
T1DB15AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 907KB
SHA256 dba87202597a8d51b790e0cfaf6ae6bec3386a20c89fa045e16848b932a45ef0
MD5 59f9cb6ca3df4e8caf7fb9d350e9d00d
SHA1 17b7cc316dcc5de7786a980d2010909f46914755
SHA512 628a0e21087c081394b4b7e0425607734c144526031e5886e197443fb513a1ec53ba93fac81cdcc332b35cba9d51c44db5272ac5f4cee25b98d09ec428d96767
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5eu:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5eu
TLSH
T19715AF17E79014F9E8178138C9954A16FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 907KB
SHA256 bc4c9d8e1956f53e271e1153d8eeac7b8757a285f1f87ac2134f7acc2320bf92
MD5 73ab101fcf0008fc445cce6627027d9a
SHA1 138b40213f6f609afb0c12bf68cecfe52c3dd26e
SHA512 9e0c415bb0df1e42a4e613863ee3f9e0e9e55cefc5fb797c527647935e45f9639713ea8ab100da85279485f145685ab519ae60e8c67b9974964615199c2e6aa6
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5S9:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5S9
TLSH
T17F15AF17E79014F9E8178138C9A54A16FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 907KB
SHA256 eb33e60ac3d744f83dab97abbfec19cba456a2ec9bd7c789836e51c1c7811266
MD5 d8f8976abcbe0d81449176e27d2fa377
SHA1 9ef7d0d8471b44c78d43337e74ebeed9fa1a0a27
SHA512 d999f8835f898a356a80d23094458700ff46098363f6daa97b34dda0eeeeb7203726387b865cd56a6cb0e01da9faa636d69e2613d6e93e73f42c37b0a025f617
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5Sc:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5Sc
TLSH
T12A15BF17E79014F9E8178138C9A54A12FBB1BC661760C6DF236892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 907KB
SHA256 f94974a674a1567bd485beab048b8e536ca749cdbfe83064d8a34e51a514e6aa
MD5 2b45c2e2bc8706b1545e6dfe4ddf52f9
SHA1 d7dc53bba87120a2968bf10a3e76ef1be9f3ac1b
SHA512 277c2cd1b98a37487352331fa5fc1e150407fab57b9cdeb81f6858ec3e56a13f733b64f57080a6f325dfe718576f8675f57f7a4020991b6fce9e1c3e706e568e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5bp:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5bp
TLSH
T13615BF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 907KB
SHA256 2637e7242e1afc6fdf4276a69fb3a51265d3309ebc7c3697ff27c506d613b1d9
MD5 a97decce300f8b3547449b480cc269f9
SHA1 4207dc52a266678239eef74a055e592bb7ce8913
SHA512 599b16491e65db2006bd010ecb6c78f4d62b20ab9a21b61a240532746bf2c6b1b15b344afdcaa28081b74e0a31833d42b5ac9e40df52f972870a7eba4bf45e23
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5s0a:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5sN
TLSH
T1E015AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 907KB
SHA256 1a407b8c10c82c0133e3bbda7b22b874f612b008b52a191ece57a29bd991c04f
MD5 b28d5209be6b81130472264f528b82de
SHA1 d5a22a1d2704a8b281327a5beca2522b3dad25d2
SHA512 be5302cacb3d582fd0c60e743998c7cfea8fb67c91cfec2cf214a65d020cc17792768ea816c28a26d6485e72d8eebdbe4d486b02f8e53c31b583c85073b80fef
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5UF:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5UF
TLSH
T1DC15AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 907KB
SHA256 a73a2bfc5a0661e10d0a1d9cbea2503631b440d5a5b86ad06e8b42312ecc1a43
MD5 6cbaf242710480636be6b1be6f1c2837
SHA1 f7948f5369bbaf46d85db8265834d594d0c5b6f5
SHA512 950eed93619538c68f5a8af3cbb471436488f6bf3ce947cc1a5a87b1748b82d7729091ab98374a7db2c670f3927f880477ca2170bbae4e87325c144e1aa2fae3
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5xC:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5xC
TLSH
T1B315AF17E79014F9E8178138C9954A12FBB1BC661760C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 907KB
SHA256 18597b001d94cd2bd50b468ff3316767a8e6f9f9b098a6e6aac1acb66bb65a19
MD5 d2473cc53c2128f255e13739168086c2
SHA1 c1f030bd412d0d7bba5a3ada4b79be94d4cf1274
SHA512 a33ba6ad941f1a2c4ae2d42a36260a3ac939706e8bb2cbcb76b167d1a6853b091e0f01db87cacfa962072cebc23f8c6b9b591c326d4a199ce8363a454a7bf806
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5Sw:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5Sw
TLSH
T13415AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 907KB
SHA256 4076f11fba8ce7fa278f48dcc3050acc1e81ccadd96d940fd7ec6575d4f2f2ee
MD5 6544281a9870c4cc8c10079262ac43eb
SHA1 5500529422e45fa92c6f04edd1c1045bb3ca523a
SHA512 3b607797585214dcd64c274ba54c860921e27b3d43e73394ba7072e408d9aec33b14d30ee799bf126173b96b4b6ba28d81b247e757a2caa3ce931fc3efa31353
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5ZT:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5ZT
TLSH
T15415AF17F79014F9E8178138C9954A22EBB1BC661760C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 907KB
SHA256 d3f7482c480b4a5b321a915c702fbdd9d0911c1bcc57537b9ddb21141efb415b
MD5 e7fc7565262b0748969787934b2c07c3
SHA1 0fdcfafef7d546ebc635cfd64a463ee68a835754
SHA512 e3d14a6d67973013ea9ec3167801a9d653eac26f088523bc66dd62f0b3e71eb31e8ae8901e39e1fcd158dabc865dbe33dfd840a0be4ddb456d77bcdffbd6611f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb53u:A3mnXoZjzyacNVOI/tTWaLl3z0zDb53u
TLSH
T13215AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 907KB
SHA256 d6c832866bb2239cd8ff00768406b214f137cf40c123bf0662084d77ae280ae9
MD5 b33c129a944ee090dc1be427d50b6bb8
SHA1 fc95a8956a9cab63d2d5809f646695538073a6eb
SHA512 225fe3191d39945c5e5204000fd88b4a5dddabe2340c235b7a43320ac51a5f6183cafb9ce7f433aeb3d9d4f11f7435b905236063bac9dd964da4cb5ed9cb64ea
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5Lb:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5Lb
TLSH
T12015BF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 907KB
SHA256 ef40e673a0857f0a7c1189b89e05a8b792d259c370795351ed59a7d242522a55
MD5 63a20f905a9306180bfd6dd29da6c374
SHA1 d57c214f792fa2b954b8ed0559871e8d2144c050
SHA512 283cab21e32beed6f22f1e3b7ee58b5505bb9f1d75b18ba87d6832bff2bff2f657ba61a3c9e5558fc60a687a32444336ba91fdfb5096389c10c356e76e0d20d5
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5ff:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5ff
TLSH
T14915BF17F79014F9E8178138C9954A16EBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 907KB
SHA256 49849b6de29adddc80ab139d5b030a3fa5b7a330c5f6060042422458b4acb271
MD5 ff5fab2c480ff7d161c257b1b92e90c1
SHA1 d0edbbd82b636461592cea9c06d386299d27a4a7
SHA512 00334cf42af201569595226e406ee3e3b33d6a8c500e89ca5a26153ac4cb611812111559b41af5b794f090adf29f92f0cb208c83a3cc0e40396622f2ae926581
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5IK:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5IK
TLSH
T11F15AF17E79014F9E8178138C9954A12FBB1BC661760C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 907KB
SHA256 abc5621585301aa2e9be484f815b9d4ccde024ac49655171328b506d512571a7
MD5 1a66f3aed10d859378af9b04f5717335
SHA1 9fa890454ffb135b33dc9b2d86840c037253f176
SHA512 c743d886ad1438d5395fc9f4d26bc9bfab9649b1532214494deec57ed893255a6b76b61caec1f6bac33767a1a7611d87262d2fb71661cab1990403c4e68ec90f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb51k:A3mnXoZjzyacNVOI/tTWaLl3z0zDb51k
TLSH
T10315AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 907KB
SHA256 eb4f319afe8fe88b44a65ebc7e917d92a7759036323b16330a162653a306eb92
MD5 c5fac85e35c2980ae2eb551005e063e4
SHA1 3cf7aae1364a01f901ad9bc410e316a3e31609ca
SHA512 8cc5e58d7222194f5f1d239441db0ad1508075e2ee3ca93242fa84bfb36a430dc171f4d03bb423d9ee6c279232683fe3791a5933939eadabe70b0b307887ca15
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5q0:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5q0
TLSH
T14315AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 907KB
SHA256 b47379eea697af3b0a1f1075b42a449ab4271420509c0189733d439ddc64cd0b
MD5 46002887d3c464c4b786b02f9bb81b04
SHA1 ba08785d1162f7fc4195120a3b05d4c3e5ceb3a5
SHA512 678e395dc9321a8e8d5ef04a3595fb2947de32420afcd0c875a01967afd1b9eddb3dde097cfff25344de0ab43bbd3337d91c5d4b957553197388657ef62ff5bb
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5Z70:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5Zg
TLSH
T1AD15BF17E79014F9E8178138C9A54A16FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 907KB
SHA256 868a6250f4bf810de2aef7f771ef9cf87493a38b346dc7207363a2ef928f75de
MD5 fe474bf063abf3aeecfe1ce0589512e5
SHA1 5a1183e7bb8f2af05723c7331680495735a6ed22
SHA512 b75d639ec7c9fa1054899a42f67b76bd08de22048835ba0f5f5b4041a25754bc28284446aa5e858084ee06a6c5cc28e8a4c1ad0d2d3e52b9c0583d60009334ad
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5Ar:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5Ar
TLSH
T15115AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 907KB
SHA256 c166f0d535801ba8173b3d72ebf2ab4e94eeb4ee341d59455fdc1e949436e24c
MD5 e042f942358e4a0e294f6901342d75ba
SHA1 8e605492e6ddb94e658af493978e950c97213283
SHA512 b88de0009b305194b5aeea8540e9407dd9a0d7456c68119c1f8a63a91867b9a78cdb2fae41ca3b7165d73f4be92d09fa1cc6d281c31510a68a34982ff6ecb8e4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5+n:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5+n
TLSH
T1F215BF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 907KB
SHA256 fa13596f49825ef8871f49c538ebcfe1e000eecb35cb5759aa0b659d31accb1c
MD5 4f38149abd200394adbdb666bb4fce32
SHA1 c6c0dc2d51d39c3736a84b468a956ad25ad05a34
SHA512 c7dd799faab1ee25c3215b6a0f677eba6e637229137080aa68e5e48aa43bc8ebd6324fc71d9f4820ccef74c39f6da1e450cb2bbcf0b7515b0805828352e8ad8d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5Ux:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5Ux
TLSH
T11015BF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 907KB
SHA256 53e1c28c7f4798dc3244916ed82105b16df3d7795ff6177b3709c2699605610b
MD5 a06a2000402c04a83c682de4f0401fb2
SHA1 a5714a80bcffd0fd832fb568ca7a231d95ee30e0
SHA512 0701fb977a8b1d0f81501e05945b52dc5aad4d1fcc3429a82229121fe2f974fc557972120def68e3a62e58a443b88bddbf1fc57f3bbc3d7a1abe0379849fba52
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5eA:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5eA
TLSH
T19515BF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 907KB
SHA256 7574c9e3573dd5abaf9f17e04cbb1cae702cad752b657ef25880d1433e85d0e7
MD5 fecaab547bfd3536bdf95c33bd00bcd6
SHA1 0fb4800d004278a69e6ceb531e2fdda22b1e34af
SHA512 816b849c0d010ad8fe2306740ad8445713c350d6f4fec37088148c30f298f5c8925e40a1a4d315195964b8295631b80888776b17ae7f55af86c2600b580d6cc6
SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDb539Q:A3kMeT1LljP
TLSH
T1C115AF17E79014F9E8178138C9954A12FBB1BC661760C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 907KB
SHA256 5d5209e11d40f7da9b48553b160a7764adf8d997e54ed14df9885b647ac88336
MD5 e126027b6ef193e14112d5a19e0e8efb
SHA1 9d70c7b07c9adfe115be400b7cbb34666cdc15d2
SHA512 132cfd0b2be91f874040b619be7bd761711498f954bc98f4aae549592f56305b18c6b211079e4a397185f19d9bc88cbf36fae65688348044da5e3b195b2f3ff7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5e4:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5e4
TLSH
T1B115BF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 907KB
SHA256 68837e6f051fa5bf97df423e7337a18e5c1361642f9d15c650f470fe0870ab45
MD5 09b9bd341b316cc7268984ce0fd1157a
SHA1 17aff065f7bfc429d970f0b3b7b38c159e439d6c
SHA512 0f2c22f99a406732fb2fecab1bc6e4435b2667e9f657f2d8fd93c825bf0c10c7d7cb141097330f0701587c3e506e803c5b97d26d91b3e205d14a5a4dc83a3c00
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5du:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5du
TLSH
T16C15BF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 907KB
SHA256 b656e27ca932d6497485ead1e9e71190dc7ad781c1628fca69a842f65f7d3528
MD5 9d36d2cb2f3877d0da33ac11ac7ebc92
SHA1 13d17aef896cedeff157b4d4229aad42562c56ad
SHA512 d0bdff6e223da1b44d5046125e1a0b2ea7825bc9c7b607aa5e33d07f0167aa047409cd4b3eda097419e0e9e8664a3a6bb4d5c37a877d70bdc1f4aaa249d8a930
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5wj:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5wj
TLSH
T14E15AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 907KB
SHA256 fd86991a7f9b294922c37d273d40660d3ecd9f15fbb6778b2127c29d25673b69
MD5 61f1c3c4bd67a584a23d6859533ec1b7
SHA1 82aa9e4cba65305d170ae56f3e9dbfea15da49aa
SHA512 ec8330eb4eeb945d5dda54abb618f40e233504ecd90823cdd890c4ccc437589b21e4154288518e6814932453b2fe51187298e996a27a86136eef0de8ffd7eb5a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5Bg:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5Bg
TLSH
T11215AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 907KB
SHA256 c85aa419fe902052ce3a49526183610d87c1cc7886433f82d5a44ea8c542d2c7
MD5 bacd2dcb553289d42f5df893e46bfd9a
SHA1 34631ad4e3e4a47d54b75b0b199ac098f745c6e8
SHA512 2ce27c630e995bed1cb0fe97c0898bfa72ac813ab776346730edd7c87362c1037645ffd85ca81fe37b98fd9caa4c2a3b052d3adb425731c7704f34d925e14f50
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5YI:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5YI
TLSH
T12D15BF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 907KB
SHA256 5084a4b329aa9d854111c961f03898c6f4e35ed2f720c5b5ededbbe363fce7cc
MD5 fe830152df540d043b706c2497b28019
SHA1 2729b92f3f0fe8d68130834941e29abcf0e13971
SHA512 fca402b8a8b1e71f7172e1d6ded51fe3c0bcdd79956b182d08bd89da5967c63f66aadc6555d31afc439f596f3908b7ab5d66c8df43fcbc5e6ae9bcd4275cf611
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb56o:A3mnXoZjzyacNVOI/tTWaLl3z0zDb56o
TLSH
T10815BF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 907KB
SHA256 b60fccc4f312e7a57bf5cb339dcb69db1a4060e2643b6b847078bfdbb9b34dc0
MD5 1743621134760cc780affaa32c15c6fa
SHA1 9fab31f12e9f4bc45a497455c4e3679e50be40c3
SHA512 4b69b9bf5c600d6e41783e1317f8b4b1d9e0f3d8ddf9a1ff64ff456e6d551baa7a36d4dbb0f111374de3a1799bc14f2cea076b732dbac1011d25efbce1f91cf2
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5R+:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5R+
TLSH
T11B15BF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 907KB
SHA256 09adc84cc65cc0318d05ff45fa123758eca5df3bf18d1c7b195f16295679c984
MD5 8e00e26caabf5ad8369ecd184124bab8
SHA1 c4b52efa717ea398946ee73b9b380f1d913f4043
SHA512 88b966bb79c13c86b483cc2939dbec699ed177493445b4b9f98639f9172de8591f11ffb9383ca8dd0b47f61e0b54606aa0d3b361165cd5836aba750140efccaa
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5fQ:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5fQ
TLSH
T16115BF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 907KB
SHA256 316cf4b4815bb10e2a8c9db20c1114e7782dc1465b200b8bf5e3d741e3e16c1a
MD5 69404b0b99eadf45abfb51960e44b988
SHA1 9c6e9d31e0fed2f8f814a1331de963be593f0c5f
SHA512 9bbf785448d80d4e5e66e62947802bc8f4dee7f36b36b862faf9dd53f4de77e5bdf4a15e4d942c8e2449f17ca50f4a099ca637ec926bc75665b6da9c9db80673
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5kX:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5kX
TLSH
T15615AF17E79014F9E8178138C9954A12FBB1BC661760C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 907KB
SHA256 3f5e8581725d48b8c3a8eee5f2785223b2e6dd21d041546a95c9c421a0ffac47
MD5 9dcd561d34ca33d566b6ad06df7c6363
SHA1 a870317c44ff925b6aefb66794cd42b217c40d4a
SHA512 8f899833708c99d68e5f66dca31354d84d0558a2a813a233e6acdb9419fcd81e1c00672d70051fd9282033f51f285ec4639c2a7f3840606b0e363d506b2d4611
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5iL:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5iL
TLSH
T12815AF17E79014F9E8178138C9A54A16FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 907KB
SHA256 b2645b6921016c00a782b88e36c0dbbb6861da783f383cbd042c34b0c524a21e
MD5 b3babcf81aba6e802e07bac31cff2f8f
SHA1 bcec7bf9a5bd45b0a63a4399801b9b7ce2e0680f
SHA512 2cfa87b60f6947d338c2406c5a2136d764c9f7428730af348813d602f9f85511c6e7fa332282a04cf17ab6235a770a261981facc8867887681c67cedd6065e23
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5GFC:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5GM
TLSH
T17815BF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 907KB
SHA256 2d4a3c6578c8dd9be02c25d1911e85c9a355c967d6ca0e94b50e569eb553e1cc
MD5 918809da3d01af7b0db8fa20cd544f77
SHA1 ec9708851430ff19270db1b3bc69f381771e9368
SHA512 49c94aedee1eb8fdeaf281a37eaf8333b8e9e30979997c6ed1a28979c5e05b12ef845a28fa75ef87edfd1dcddbb4c5c17d716c168cc516c61fa7b46727e38873
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhb5vh:A3mnXoZjzyacNVOI/tTWaLl3z0zDb5vh
TLSH
T11B15AF17E79014F9E8178138C9A54A16FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4232-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5396-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5396-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads