3bb280b8c8ac959bd0e09f2fd3ad5c5dfcf5c9c3c06a74475b36531efae7cd70

Analysis

max time kernel
101s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 744KB
Sample260819-valnjaybrf
SHA256 3bb280b8c8ac959bd0e09f2fd3ad5c5dfcf5c9c3c06a74475b36531efae7cd70
MD5 f8608c508b7dadd9d3273b526934ef3a
SHA1 d9b1119536059a0faab8416cb7b340b3d94c2350
SHA512 b080d4c945723d77b4e93f121106829cd878991e75a20766ea63b9de4202ec9616b484824b174f73bad26a25b230ff28b5534531c70b5dbc0bb0bc4f770dc222
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0a:A3mnXoZ643mnXoZ6iLa5D5TvinrmltN
TLSH
T15CF45A17E6850FA8C00FC1748A968A72E6737C161F20A7DF1354AE253F72AD06B3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/4128-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c53a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4128-100-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3216-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-477.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-587.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-691.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1064.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1107.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1157.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1357.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c53a-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-477.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-496.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-587.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-691.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-743.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1008.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1045.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1064.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1107.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1138.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1157.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1220.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1324.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1338.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1357.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1376.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3216	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4128	2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
3216	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f8608c508b7dadd9d3273b526934ef3a_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4128

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 744KB
SHA256 3bb280b8c8ac959bd0e09f2fd3ad5c5dfcf5c9c3c06a74475b36531efae7cd70
MD5 f8608c508b7dadd9d3273b526934ef3a
SHA1 d9b1119536059a0faab8416cb7b340b3d94c2350
SHA512 b080d4c945723d77b4e93f121106829cd878991e75a20766ea63b9de4202ec9616b484824b174f73bad26a25b230ff28b5534531c70b5dbc0bb0bc4f770dc222
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0a:A3mnXoZ643mnXoZ6iLa5D5TvinrmltN
TLSH
T15CF45A17E6850FA8C00FC1748A968A72E6737C161F20A7DF1354AE253F72AD06B3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 d238dcb34c08105283a9e9a169102f2db2675198584644b02cc169ed2edba200
MD5 28154fb3dad7b04a166ca733ce47ab69
SHA1 de4f89cc926c80c9e07d5a4839173667de130ead
SHA512 7cf79f197f3ec27d32ad120ad7706ef0980cf8907287a43d7e599c24cfe7535a2e90d87f81e83c3723a2adb4da7b37ed07f357ed429e09939e6db969a93c6fba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmltZ0Le5ji0hmxNrM:A3k03kB56rYPji0Aj
TLSH
T136554A16F6A44B65D02FC078C5D29666EA733C411F3097CB1354EE283F67AE19A3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 759KB
SHA256 6dfb7e9ce0dbbb5bedc62c10e6074a0d232128a5bff27f0611fcd2758bf7818d
MD5 3a577ac7f5fd8ad905d8aa94c6e562e4
SHA1 9740e4208062b23361b56f73eade792e015519da
SHA512 4009633be4da26b8e6beaf05a63a10830e211dfdcb4edd2ec696b185fa59fea3137f6bffa060e2011cdcf06e85278152e222b19dfd5014cc1f6e539cd86a4a10
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0ka:A3mnXoZ643mnXoZ6iLa5D5TvinrmltLa
TLSH
T1A7F45A17E6850FA8C00FC1749A968A72E6737C121F20A7DF1354AE253F72AD06B3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 768KB
SHA256 da34eda2cf2ce06332d7e2e5d7eb30567da3308b983f9a8da20b0f5217df0bed
MD5 0171ec4062a02b3c6ae22a51dd8fcbe7
SHA1 c7abc4776f037b0b060846b52c68997b06219fc9
SHA512 53f9a014fb0fc8ca26ebccc9176bddeac7eedff324d1d4312303147be4a9118ad6bffe35f22824bbc6230e88f725b0d14eff364e44a2ab4e59dd99321919df53
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0d6:A3mnXoZ643mnXoZ6iLa5D5TvinrmltK6
TLSH
T1B9F46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 768KB
SHA256 4dbfcc58a6acbf45125ee7a03c5a7e05f0d336b20fe74f45b194a51385ed90c0
MD5 93b30c6bff62c6958eb2c75eb0e87a85
SHA1 1ad50e6309a4418cd7d7eaff6081a970f38a5083
SHA512 018ba9e49920b81f208daece771725b48dbb8d3693aefcad6cfe6ed43d3ef5175a4d825e722156203f73355464a498e16661e99f97beb6442613eca6cc9d47de
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0zN:A3mnXoZ643mnXoZ6iLa5D5TvinrmltiN
TLSH
T1F2F46A17E6850FA8C00FC1749A968672EA737C161F20A3DF1354AE253F72AD06B3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 768KB
SHA256 1df9ae6ed5356ae6dee04e1953a2a2a7742a7a8e7b5ffe8502a29b64735153a7
MD5 6087397f1054025390d70ee0f29c5df8
SHA1 c6c2f43f44461896c5e38b2d7e9773f81196ad62
SHA512 d6f195f900c019b4773a2b1fb243ab35f2ad5e6fc0b335adbc8883c522d8b3540077351b8d78304242b9e536c581b218df44f17c960f839dd4110fcd434b48db
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0Bf:A3mnXoZ643mnXoZ6iLa5D5TvinrmltYf
TLSH
T1B4F46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 906KB
SHA256 c7928a0a02fc355b5522bc471f0b1bd3016cc720e87ec501c82dd1c3f1ec485c
MD5 8e1eabbca555c45b890dcaeffcb57b0f
SHA1 0210d86bb8a0f87c14e1ac0229bb5c9032eb11ab
SHA512 94e2966aefedea82c8ffdbf61f188e1305157029bcbc277a150739ea2ebc9a97dfbbd261d076015c47ea86bb41f6ca27850c1168f222aa7f353c7234f8f18e0c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmltbzy7:A3k03kB56rqs
TLSH
T141155917A6950FE8C01F81788A968A22E7737C121F2097DF1354AE253F72AD06E3E757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 768KB
SHA256 e398e286c1437be66da37b4bf3b8120e7f876bda006b35dc6ff8fd98f4ed03c2
MD5 1fcbb40e09543266aa7afe116852af8c
SHA1 7511bf712e2f18514d898db75b73033c23f25cf7
SHA512 8720843844966684b86060485b579a3c74c431898df5eb6ad13fc316ca4c4658b503b71d6a4959b3e184f13cd9516455fe3bf18e7f7262a8fa42e92e645f0da7
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0jo:A3mnXoZ643mnXoZ6iLa5D5Tvinrmltyo
TLSH
T15CF46A17E6850FA8C00FC1749A968672EA737C161F20A3DF1354AE253F72AD06B3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 768KB
SHA256 11cff977ba159f02f29d299e90234eb1c91f1cb37aee5de759eafe5efb3cb2a4
MD5 cc8f83fbb6cf68b4f6b4240d4943e036
SHA1 5ee2252302c6317b0aee9bf9b597abe6d4d4cc40
SHA512 b16d4c36890ccbaa43492253db2fd3d343f20dafc6277d3c6b87fe6fcde8cfb637e04c639b13903de8ea7c88fed4df34c21a9114d73eee62a7c04f5efd5114d5
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0Xu:A3mnXoZ643mnXoZ6iLa5D5Tvinrmltmu
TLSH
T1B9F46A17E6850FA8C00FC1749A968672E6737C161F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 906KB
SHA256 11b35af487935fcc184561a7e0f46c1dbcfefa20450d0aa607acc0fe34e8e0f5
MD5 4b2f63d4025ff3986ccd06c6700322e6
SHA1 a84ae9968eb367110521d58799f50584fb9cf381
SHA512 9f661b072d267de65f35749f391b9350a84ef9d0a4c20a6c1094c030bda6673b0ee0455e0867d1d9090348836de8b028321e12e9cf7fbf217b3f3bb5d44eb064
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmltOzy8:A3k03kB56rXT
TLSH
T1CC155917A6850FE8C01F81788A968A62E7737C121F2097DF1354AE253F72AD06E3E757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 768KB
SHA256 996a8f5c97ab510bde5bb0de3345e4677f34b1bbddd2b130223a0312fb72c9c6
MD5 45ce6972e5b4f98d81a5967effbbcef4
SHA1 bbce7273b4a3581cccc5bb2220bbf9f0ea591764
SHA512 59520d0bd14b2031869c8a99114ed5935a1b232788aee566bd26daaf1f5ace4e4ec84dced0c3bc0549824c7f565d6273081a46d82bd13baa21426dbf7aa2d1b0
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0l9:A3mnXoZ643mnXoZ6iLa5D5Tvinrmlta9
TLSH
T1C9F46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 768KB
SHA256 1dd536dccc77f667249889943cbbb8d59d6e261b4ec532f3700ce71a5b30d898
MD5 d6f8995f9e4302da6bd548f8b9c3a985
SHA1 6f5936a4f32821db368204072e0521cecb220d30
SHA512 f32ea3afdf5e1b5b6ea0087c2b027571e35c049c8a91af8208580f5df5b4df825dc97e60c24f346d57c4e66f07e79319009a8a407efcacc2132b31acc6ad7e76
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0Bc:A3mnXoZ643mnXoZ6iLa5D5Tvinrmltac
TLSH
T15AF46A17E6850FA8C00FC1749A968672EA737C125F20A3DF1354AE253F72AD06B3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 768KB
SHA256 d910d43aefd1358c752cc30c02276b76f4a44f36860cf5abcbded20e549ded47
MD5 fc27f63874307dd79b6231d307f4dc8a
SHA1 1b35fd1e22b851c688b155c0e1ecbb3db7f64e08
SHA512 cd806dab04d82b07d68c0a05d13d8e99ad1d7c548d7806a929d6e0dcd4412f4e41bb0655684c533d560732e1cd2b6d2a46077d0a6fbb3626ab8b7e30530aa38b
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0qp:A3mnXoZ643mnXoZ6iLa5D5TvinrmltTp
TLSH
T194F46A17E6850FA8C00FC1749A968672EA737C125F20A3DF1354AE253F72AD06B3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 768KB
SHA256 6cf4c50407b602345bb422cdc540d2810eb9fcde2a58fd086f95e0697ae1e1ac
MD5 78bc3091c1d26440749491a100679108
SHA1 a1c01a6e0ba5090bf6d497c58698f9b4692e37d4
SHA512 9f78d9df6ed8c2b1c990467abc8bb3cb966a3da4562e2e84f2a7153f416621426e5b3c96fa0cfb7eb0e69518b190eb3c542ea79da57f61e393d98c3034d82d2f
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0N0a:A3mnXoZ643mnXoZ6iLa5D5Tvinrmlt0N
TLSH
T1DCF46A17E6850FA8C00FC1749A968672E6737C065F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 768KB
SHA256 8d70f0bf06709a8b616da8b7ecb391d513b671a77aea05123ba9cc8a84568d72
MD5 b18f68d151628ae149a3f7850ee8cbca
SHA1 f2806a73f38722381f03bf2ec91159a406a777ed
SHA512 fae9e720f41df86cbfad1344369110a52574a9123635d88d24d8d849010132c07617a3708928aae3b3049124bd4ccfb31cde11fcc11f11ca3d36e68579ee89c1
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0/F:A3mnXoZ643mnXoZ6iLa5D5TvinrmltcF
TLSH
T173F46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 768KB
SHA256 abb8a89c22a7c272ccd1712a1d038d0bd3531814061b0c0e20aa328b904caf7f
MD5 51afb2109810e1ce7bec4fe9e67a09bb
SHA1 7fb9bc72a05a15037c2ec4c374b29ccf9881d9df
SHA512 e89b908029b50c12b980be4c4f74202c321e4fc4cb92a8d1ca0787e449612396e3febfd136af722434451022cfcff333a574c346b2fddb609c01fc7318ef0b69
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0gC:A3mnXoZ643mnXoZ6iLa5D5TvinrmltJC
TLSH
T1A8F46A17E6850FA8C00FC1749A968672EA737C125F20A3DF1354AE253F72AD06B3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 768KB
SHA256 5171b7b542bfceddb028c8a0222bdd0b2c2161d11518c5c3230d93b9486aee97
MD5 59f9855324ff70b53b92e20b92f33cf8
SHA1 8d2cee5119f9c2b3535c8057a8c770cc651286bb
SHA512 1660781c10441869e483ace2edcb7b8f5fbb4846535a16c0980624afab0df3acd23ac300678c045e9ec64a9ead5b4861ad23db97aa3d8a9c861509313ad8d564
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0zw:A3mnXoZ643mnXoZ6iLa5D5Tvinrmltqw
TLSH
T109F46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 768KB
SHA256 eaf2a8b3a52633ad0985d60ba8b9720c7f471266a16a959e13ed85d095ec1207
MD5 2463305201bc6e8cb7f8cfaedd5d4080
SHA1 b7c50f1b6ee216ad3d4609e1fa25932b88606e2b
SHA512 f6b0505320b1ac591040c037cb49f3a69343e8eb9961ad2b42539ce4b0397ffe442acadeddf0c65ae13eddf94545091dfdf7d71d239e481d7bbef031597823b5
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt06T:A3mnXoZ643mnXoZ6iLa5D5TvinrmltxT
TLSH
T1CFF46A17E6850FA8C00FC1749A968672EA737C125F20A3DF1354AE253F72AD06B3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 768KB
SHA256 04a0f77d2592a413911c0d58fac2e8f64216bd84e398a60917cb5499f0130d30
MD5 a7393263d2ddc21b7dc829780a86526d
SHA1 ba8c1f1551b14743cf294d6b4d2d927f2bc2fd2b
SHA512 6bce8b3d841ecaee8d7b2ae3cad8ec680d42595d7e404601b17dad48e7987af394829b692000e88d2645d542a56f572d1398a2fd37a4cd8f6ae6e5a147723fff
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0au:A3mnXoZ643mnXoZ6iLa5D5Tvinrmltfu
TLSH
T1BBF46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 768KB
SHA256 cac501a76a03dd8f2fc9f764a9d5c63db86e523041d29c9f825f7c678d597376
MD5 7ba749f7cd07ac9afc1ea1a6b69358f7
SHA1 b792891a5d7a3fcd39ea73ae6ff2d8622a47f2a7
SHA512 d65595817b7115348264ca76fda71b53403f4d289ba78b8d90fb31a0c04c1976997bd3e944278d13205b7243fe0ea4ee41fda74c3cac52b9a4234e513472b773
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0kb:A3mnXoZ643mnXoZ6iLa5D5TvinrmltDb
TLSH
T10BF46A17E6850FA8C00FC1749A968672E6737C161F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 768KB
SHA256 8a6ddc31fb420f1a1e38906f12cf1b19b42352754d449d1d9775b8ce132101a9
MD5 62318b70fa04205fd23ef205835c40ff
SHA1 a09b07b48dc7df6648c8dc337a110483ce6e2892
SHA512 74e4a0505d37b50c5f6e46d80cd970d86c0e5cd1040c9d03d0f3d56dfdfd644c924eaa7b5115c2309f0318a04fa12c426f8fde5f4bc96b692b75ef8026602f79
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0qf:A3mnXoZ643mnXoZ6iLa5D5TvinrmltXf
TLSH
T12BF46A17E6850FA8C00FC1749A968672E6737C161F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 768KB
SHA256 f05ae0c0e7b694e402f565a6c813496d314c887d3165869e394b38cd13be1403
MD5 c5e77995215fd8208bbc1af552000b9d
SHA1 d455f2924f1f6afffe6122eade4cf7af2a855e7d
SHA512 91208f19bc8cffa383db353c4197f07fdf15414626fcda0c82636703cb022f4d646469344ad87d8264fa4135dcfe5e178084661337e0183a27fa2f3253361e75
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt03K:A3mnXoZ643mnXoZ6iLa5D5TvinrmltgK
TLSH
T179F46A17E6850FA8C00FC1749A968672EA737C161F20A3DF1354AE253F72AD06B3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 768KB
SHA256 6919fbab67d700a6dbb9c6162da008ae2b7afeae34c510e955e6923cf6d7a947
MD5 a8df524b592fea1dcaa43bb327622a56
SHA1 ac4606edcb02daaf2eb46296c50a76cfeb852e6f
SHA512 41f608a1b6a80995e88838cd694267da6a436030997fac2f85a2da174953b1dbe9112fd1f363c2924e1489adceae5c2fd7e48b3483b0513115bc6ee3d4932e8f
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0Ak:A3mnXoZ643mnXoZ6iLa5D5Tvinrmltdk
TLSH
T1BFF46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 768KB
SHA256 ff4b39609e00e34a60bde187a0ffb069ebe88ca0d4c31ea1f6ff0b820d05f5d2
MD5 ac24f4ce8e30e738e8f91bcc9a8cca4a
SHA1 979fe246897ad51a693d83b5a97ba195a396683c
SHA512 8e9062058d7097fd6571139a820f58657f3c4c05f89e56fc3c4ee0d818e95a65146b70c1a9532843c0c1dcf660d019c9f1999184ad0f9890d5140e1006ff6a2f
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0x0:A3mnXoZ643mnXoZ6iLa5D5TvinrmltC0
TLSH
T1DEF46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 768KB
SHA256 7fe2b9c5b9957344a1c59b3b973e07fa22da61c4c9a2b1a54216fd6a69320abf
MD5 e03f922c8a8b18719ec534037e3dd081
SHA1 8f4c7046a53ba5609df01262d2012a02d131e774
SHA512 5a94db19fff4fe67aed852415ba085e99307b26a3a7bf42b78ab5fee2f8d4dded9472f2b3cf452468496f0d0aae3994376a2c1dbce46db9239100c3742d0afe1
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0k70:A3mnXoZ643mnXoZ6iLa5D5TvinrmltRg
TLSH
T146F46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 768KB
SHA256 05d55aedd55b742bbf64692b1fc08fc74c4a52ebc611ac2bea872521cabba110
MD5 afd0110bae0b6b0dc7f45e916f4cba5e
SHA1 919dbc5caf6a26f940e43b032466de615867f871
SHA512 a5a891d1e9bdcd7da4b887f1aa66d50bdedfdcf7ffac793375692fbcd154eb615102e8378e40159398a975f178ad731bad1ec924aba4411f147234c1048a4535
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0Br:A3mnXoZ643mnXoZ6iLa5D5Tvinrmlt4r
TLSH
T1ADF46A17E6850FA8C00FC1749A968672E6737C161F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 768KB
SHA256 218dd48ee8a24c5201c973b1ec8f014a66eac8043dd493e4c4036062e810fa25
MD5 4ff5477e5a59751ea847db1ec9de6a75
SHA1 19f987e9b05945d823fd3b63469442190200b5fd
SHA512 a186c9d721d881c8cae7ab18c3444d443d988697aba54142c997bf4844bc6b2f270602bb527524b40e5dc48147a7825ccea82036eb9a6aa023330c433c22eede
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0Dn:A3mnXoZ643mnXoZ6iLa5D5TvinrmltWn
TLSH
T195F46A17E6850FA8C00FC1749A968672E6737C161F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 768KB
SHA256 bd147a4a3ea0aaea0c449645ac1043178197dfb6a09b2c93af04a0d453c1e81d
MD5 de186ca697cddbb90640228fb49a4549
SHA1 1bd70be3a55f0863662f75020e8796be497d610e
SHA512 1855ce971420e20cdb711ab76012d96e8ca7a49ae9fab5593b15644d3066a76c1c7ef403c413a642d8b2673e1f1a6d52a60ecc5420aa1845560708d89486c6ba
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0fx:A3mnXoZ643mnXoZ6iLa5D5Tvinrmlt8x
TLSH
T17BF46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 768KB
SHA256 b48c6bf12abc8c5dee79721f9e38762b438f7ae044cbace79d15f2e569f90afb
MD5 818a20845b2ad6494f8aaea3476d97ea
SHA1 ffce412618bc4c2877332ebbfab24dd53cceaf8d
SHA512 b4f4184868cabed53cf21f8047603b772120e0d4b27ec24e005d8fadfb4b0e918fec786178c2f5f3533a6701a7c1ccd9d182965a184d80850bc21ee70363767b
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0FA:A3mnXoZ643mnXoZ6iLa5D5Tvinrmlt2A
TLSH
T125F46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 768KB
SHA256 1949bc4a6372b1248e7ab3f2f3ff9437769863245b766c3781d10d17467a16d0
MD5 b15547c1df5f4db169003d8a82f0a4de
SHA1 9413c3e6602f89e1f51c3ae197b66f485c87b16d
SHA512 0c967f614533f304efabc388fdd6b439c765b0d1674cdb99dcc7590301569fd7ae974ad0281d0e736fc089e87a48dae55ba6ac63e7f7274d5b9708300bbdbc09
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmltv9Q:A3k03kB56rd
TLSH
T1F2F46A17E6850FA8C00FC1749A968672EA737C125F20A3DF1354AE253F72AD06B3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 768KB
SHA256 55b24a72701b9c959a81963a5ceeb08eb515de291ed95769c68b800978cf70a0
MD5 23e42a004cb7cade5dd2dd14ce1b59b1
SHA1 d6c73f9743cb44e02c3d85f7696932408787af7c
SHA512 9e5f4586f0d6ce03b6d3dacd966d8099314f49fe12ef35c0a7238c03d9ace446d8d2a8e093087b5328fc551eefabaa3c398d0198b58bcb1ccb20153201d8a096
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0r4:A3mnXoZ643mnXoZ6iLa5D5TvinrmltG4
TLSH
T1EEF46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 768KB
SHA256 150a354035bb50b7eb2a45930797407f6e23204e0c3073b7378e86ffd223be0d
MD5 665cc26bf7448c999e7de584d4d6a250
SHA1 596f51609cab8625113203916916a0a9012d5f95
SHA512 1bcee7df5a522f0993d87481b45378b3368995a80064a7b072a5f396e944a727706a60e0a2c8e6f0e208f8dccb4ea9dd0b64fddd9a076817a84757fce15befa0
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0iu:A3mnXoZ643mnXoZ6iLa5D5TvinrmltVu
TLSH
T141F45A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 768KB
SHA256 fee8a9c147638950e9f59809883d4aab2bd6fc7db8038628e5956c4894eefcfb
MD5 040c5a0aa3fe13d2b81130862e90746c
SHA1 394b9f4efd087273dae2f419ac993dbc49d610d1
SHA512 034073c0a5fa6f156d28bf7003e7925ec3e90abb544d3a8708214cd0190a4e6022a50955e6911510a71bae3ea5d0c38ad3ce660ae515a0e2bada61c22537ef6c
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0zj:A3mnXoZ643mnXoZ6iLa5D5TvinrmltIj
TLSH
T18BF46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 768KB
SHA256 c9b46830497045d0fd631008658c0671d945c0ace29e93d9bf15018227a882dc
MD5 b4b6f50dd1dc77c5e1eb660a1095737a
SHA1 2a9afd041968119aa74c47198180d7c246c908ca
SHA512 55e443e6702d0d6ea1c060e385f992ed119b2e181f9fe53bf11bb66925ec644f085e52a589b294a8052763901e5d0c71df836b1af7c01f52704c932aa9fa25ce
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0+g:A3mnXoZ643mnXoZ6iLa5D5Tvinrmlt5g
TLSH
T179F46A17E6850FA8C00FC1749A968672E6737C161F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 768KB
SHA256 a084cd1a31c909f8fe6421e5cb1c1daeb5b5aaa8cec7162d631b58cc9da7fa40
MD5 90ab8d6baab56921337375b0d3f6e9d9
SHA1 c31654e4e71997a1324e73f88d1323937e821782
SHA512 fd14ada2799d889d02011223ca9af715f6e50f5b2506937c96ed3b35dab3f470f832b35c6f9819272069acc9d70493cf74ecec1a0199f7da54105ab7181068be
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0xI:A3mnXoZ643mnXoZ6iLa5D5TvinrmltgI
TLSH
T1DDF46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 768KB
SHA256 fcbee1cbddba7d2b88ca87136f62407ad50d7c13bd94f2827a3b1db03f9f6f85
MD5 423d3da252f48ae789d548c051743201
SHA1 8937f210da627ee003abbb8747c7f8e7acfaa726
SHA512 b34f5030f7dc519f8eeba6d00328ad12423b706c2b7de8b9154869a627b93538399f78bacaceb9b869be73a8be936f0c828067d411fdd815db0d9403a535f1b1
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0zo:A3mnXoZ643mnXoZ6iLa5D5Tvinrmltio
TLSH
T184F46A17E6850FA8C00FC1749A968672E6737C161F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 768KB
SHA256 93729def3018ff6114834e75189f5fd48921383109d33cb9cbc9a109e210d352
MD5 12618b26826d4e2aa0e635c71b5b2a93
SHA1 c4f0a827caff4d11a18eeb2deb11250a78348be9
SHA512 760f7715dcd7fa804d09d53a8d123be189cdc78dfd098d4c13b5187a8143b7a899e11eef487f2f781907d930fdf5f276c9199c825238cc336d136cab5b87ccfc
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt04+:A3mnXoZ643mnXoZ6iLa5D5TvinrmltZ+
TLSH
T106F46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 768KB
SHA256 e25d15490850b3fa45ea977322ff7098275eb6f464eb82b5ae521d84fed1fa1b
MD5 5d78c148b7aff101bda656ba2e5c8236
SHA1 e9090dbcc5216cf7fc125845b7c06bfe80edae67
SHA512 c8bdf0fbcd3c1844ea82ec2fb1d5153876513ecf6380e9f7a315ba058298ef057310e3400c36b7f7a355387819dd77eb7d416a24c4468eff76c2145b3c3ff7e9
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0QQ:A3mnXoZ643mnXoZ6iLa5D5TvinrmltHQ
TLSH
T1B6F46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 768KB
SHA256 5a316b1258b606e896a0598447c5139b341b7af72d376a208fba9c5585720a48
MD5 e3c1605283ecd495ae08650eb9974879
SHA1 df9eb8a27c7004bd438de6fc44f9d8d4bef7a5b8
SHA512 b7bef0f3bdfb92a21e7ef4855c0fa3c6c5046d5a55f3c38a6f18f308113e0cdf4b31f8e7cccc706307ec752cd86fc01517115b226c969b0bc7653354bef0d1e7
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt05X:A3mnXoZ643mnXoZ6iLa5D5TvinrmltcX
TLSH
T1ABF46A17E6850FA8C00FC1749A968672EA737C125F20A3DF1354AE253F72AD06B3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 964KB
SHA256 1d83d57f9592d23b8000e17a9c78c3a31a7102edaa4131df28c964851cbe4ca1
MD5 af0cac92207f0305930bfdec06a5ec72
SHA1 de602b91b1f841cbba378b88367212a8e301a415
SHA512 d5dce7d44514e96b5e65fc59a8f28781f66a20d274335d0fd7b444c6397ec7f3b9569a95c7c19fd1b129280f29fdbb4a2b4d51e4cec14dc60b76974f710e61cd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmltLjCXF7IwZ:A3k03kB56rEC17IwZ
TLSH
T1D1257B17A6850FA5C05FC1788A968672E6737C151F2093CF1394AE253F33AD06B3A79B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 768KB
SHA256 142ba102d45e4670f903eb5097b6fca6f1a2ca78d48b57b989e2d89883bcb750
MD5 06b85f54d8212442ac379c5adefe6503
SHA1 06317f21ed7c22747d060b0fd007a7b2305c26de
SHA512 93b3d9ab7c7c27a680ff543af855c63de14a6a39a866d014258fc3fa4882117de230a027ee6faedbd8fb9fda214125286276f13f8428bb0f27d5dce786db9a43
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0TL:A3mnXoZ643mnXoZ6iLa5D5TvinrmltaL
TLSH
T1FCF46A17E6850FA8C00FC1749A968672E6737C121F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 768KB
SHA256 27e68640b17351ed72169bfc883a48ab92f9170987e90906894d9aaeb6dfdeb7
MD5 dcc58a3cb9ac608809f7ae2ba7d1fd4e
SHA1 44547fba477f7df44ef6b9bc758d4bdfcc7eaa5d
SHA512 224b8f98c53683286e9d24985eccb80246041a387728b4a7f6b2df54609321170349a307dabcdcf1d676156f9dbaa9548edd8c564f12ab6204793c04a08b81e3
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt05FC:A3mnXoZ643mnXoZ6iLa5D5Tvinrmlt+M
TLSH
T126F46A17E6850FA8C00FC1749A968672E6737C125F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 768KB
SHA256 e3a2d07378fde0efdc2764502e0e5d0a4b9cdcf3302b3f05a60a6f04765ad62f
MD5 92b980420fa08df101160df5e638bb3c
SHA1 ace4488482ce680336b142eeada9bfe096042ea3
SHA512 a270f40136e0310678a69466c55cd35008867c13bf848284bb8f1f7ac0e7f20e22491722ef93cff09fa0d4f1c9cbeb0dc224f6141497ec92110cc7cc7e0544da
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6iLa5D3JeU7vinrmlt0Ch:A3mnXoZ643mnXoZ6iLa5D5Tvinrmltnh
TLSH
T16FF46A17E6850FA8C00FC1749A968672E6737C161F20A3DF1354AE253F72AD06B3E697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3216-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-100-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads