V1.0.5.zip
- SHA256 016a8932867e00ee81b7a32ae45039ebcb494f1bc833a5ebf0b9305f22e8a54c
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
LionInjectable.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral2
Sample
LionInjectable.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral3
Sample
client.jar
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
client.jar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
payload.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
payload.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
General
- Target V1.0.5.zip
- Size 1.4MB
- Sample261018-smnmjset2m
- SHA256 016a8932867e00ee81b7a32ae45039ebcb494f1bc833a5ebf0b9305f22e8a54c
- MD5 ed001f4f7ccb97d5789f356e7db32f24
- SHA1 98a0fb6d1f6d9e7282149e3f7306496c1b8b26d8
- SHA512 d39f9923b0e17bcfac246e5d460f416e4600e7be333cb3cb6151e6e2ee4cdd21da9a98cb1c4c795e52665d9b2321ce746a42e7ad1d8a74c0c16de7a47aa5a84c
- SSDEEP 24576:rSGgY63NsnDRzpdVY2uGrz3+QfEGyV94+qqfAKvMiYUDM4WGil5EbLscy5sTckcJ:WGgZdkD3dVD73TMhg6VpY0M4PDbrWsTS
- TLSH T1EE6533A14F913E8B7627D264E24686B6F787138FE15058C3A750F9B089F728FCB89650
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned JAR 1 IoCs
Checks for missing JAR codesign signature.
resource unpack001/client.jar - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/LionInjectable.exe unpack001/payload.dll
File Explorer
-
V1.0.5.zip.zip 1.4MB
-
LionInjectable.exe.exe 275KB
-
client.jar.jar 1.3MB
-
payload.dll.dll 204KB
LionInjectable.exe
- IMPHASH 15b72b1030608ded1bdb724e37513662
- SHA256 d841bd3e0d1678b30e9c13fea3334b5abfa677e69ee6f64d5735faee1bb35b64
- MD5 c434a2d8f65eb6b7beb1e8b3f44f9914
- SHA1 e66bd5ab95f1f026dcb476b6288d208d844ccec9
- SHA512 5f7579109e6c9b03497f15cb1611a9ebfb9929ff6dec40fd5ee81f624632ab350d3122ead9d22384e2def5c1d1fb68caac6cd5e6a0f8ec37919dd2368642c567
- SSDEEP 6144:fs30FtPZiOdsa+xF6qQCHxoEwn6IjMMxds1oqMZHuAx9CnuFB2539kWQvNpuv22R:vqt5nlv22i8X
- TLSH T1B2548B1ED242296DF23B817DCAFB5952F9627C0C03D1C9CB13A199E81967EEC477A312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
86464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Lion\Desktop\trash\LionInjectable\build\LionInjectable.pdb
user32
DispatchMessageW
SendMessageW
DefWindowProcW
PostQuitMessage
RegisterClassW
CreateWindowExW
ShowWindow
MoveWindow
GetDlgItem
SetTimer
KillTimer
UpdateWindow
GetDC
GetMessageW
BeginPaint
EndPaint
InvalidateRect
GetWindowTextW
GetClientRect
GetWindowRect
MessageBoxW
MapWindowPoints
FillRect
InflateRect
LoadCursorW
DrawTextW
IsDialogMessageW
TranslateMessage
TrackMouseEvent
ReleaseDC
SetProcessDPIAware
EnableWindow
SendMessageA
GetWindowThreadProcessId
EnumWindows
IsWindowVisible
GetWindowTextLengthA
gdi32
MoveToEx
SetTextColor
SetBkMode
SetBkColor
SelectObject
Rectangle
LineTo
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateSolidBrush
CreatePen
CreateFontW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
comctl32
ord410
ImageList_Destroy
ImageList_Create
InitCommonControlsEx
ord413
dwmapi
DwmSetWindowAttribute
gdiplus
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipDeleteGraphics
GdipDeletePen
GdipCreatePen1
GdipCreateLineBrushFromRectI
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArc
GdipClosePathFigure
GdipDeletePath
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipDrawLineI
GdipDrawPath
GdipFillRectangle
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipCreateStringFormat
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipFillPath
GdipCreateFromHDC
kernel32
GetLocalTime
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
OutputDebugStringA
GetTempPathW
LocalFree
CreateDirectoryW
K32GetModuleFileNameExW
K32EnumProcessModulesEx
CopyFileW
GetProcAddress
GetModuleHandleW
IsWow64Process
FormatMessageA
WideCharToMultiByte
ReadProcessMemory
QueryFullProcessImageNameW
K32GetModuleBaseNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
FlushFileBuffers
WriteProcessMemory
VirtualFreeEx
InitializeSListHead
VirtualAllocEx
OpenProcess
GetExitCodeThread
CreateRemoteThread
GetCurrentProcess
WaitForSingleObject
GetLastError
CloseHandle
WriteFile
CreateFileW
MulDiv
GetModuleFileNameW
GetTickCount
GetFileAttributesW
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
uxtheme
SetWindowTheme
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtQueryInformationProcess
vcruntime140
__std_exception_destroy
_CxxThrowException
memcmp
memcpy
memmove
__std_exception_copy
__C_specific_handler
__current_exception
__current_exception_context
__std_type_info_destroy_list
memchr
memset
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
terminate
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_execute_onexit_table
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_initialize_narrow_environment
_set_app_type
_seh_filter_exe
_crt_atexit
_invoke_watson
_seh_filter_dll
_crt_at_quick_exit
_configure_narrow_argv
_register_onexit_function
_cexit
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-math-l1-1-0
__setusermatherr
sinf
api-ms-win-crt-string-l1-1-0
towlower
strlen
_wcsicmp
wcslen
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vswprintf_s
__stdio_common_vsprintf
_set_fmode
__stdio_common_vsprintf_s
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
_callnewh
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
220KB
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35207,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=29, id=261, version=35207,
count=17, id=257, version=33145,
count=207, id=1, productName=Unmarked objects,
count=5, id=261, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,
client.jar
- SHA256 433b7f18d5b55848abb2bb33c298d604a67e9b60aff321ad11391e4e06418eab
- MD5 0766b80f37fc770eac8afec0d040511c
- SHA1 c28562f3fc989c3378fd2166323f5bfa4d32eb43
- SHA512 bcf90869a52287dbd7359b6987a53b61295643912c0402ba43255d5d9331667aa5b913f22d727e53b23ee1f117ec4ef57eec54e20c9d5e64a955d9792dcc7ec3
- SSDEEP 24576:DRZX9TdrSE541PWH+B/3+yfMSybFoecqMlKrEiYORM4OGi5VB58cMFspW9GHZ1w5:FZXDSE5wf3vkzUNI9YuM4XIVBd2sUo5e
- TLSH T14055136155EDE8BADD3B5332F2844122FE3E13DDE08A50A368687AC568F1D891F4C79C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned JAR
Checks for missing JAR codesign signature.
payload.dll
- IMPHASH 83785fc736942acb56389e2fe06a7012
- SHA256 b900847ec44942d99732b817fd870ae81a44b71f658f0a57a6b484b36175f6dc
- MD5 9ac1a46d64e05533e93db904c6d78189
- SHA1 b772c3e2fb6a2df5996b1aaf237513eacc0d55c9
- SHA512 0d1f4507d4540c4d6cacf32864add0d219d7a8521fc6f907c594eefe0f357e807aa690b6bcc59d9fa03647c5c6acf34cead0042ca493acd1ffbd52fa1f6c0e7d
- SSDEEP 6144:b3M5u0myk1oqMZHuAx9O8ZVFM2X3NkWQFep62XGntW27p:vuU2XGZ
- TLSH T1AF248B1D9592396DFB2B803D89BA2562FC22BC1C43D1C9C723B299F80997FEC5379611
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
168000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Lion\Desktop\trash\LionInjectable\build\payload.pdb
user32
GetClassNameW
EnumWindows
SetWindowLongPtrW
GetWindowLongPtrW
ClientToScreen
GetClientRect
GetWindowTextW
GetWindowTextA
GetForegroundWindow
IsWindow
SendInput
GetAsyncKeyState
IsWindowVisible
GetWindowThreadProcessId
kernel32
GetStartupInfoW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LoadLibraryA
GetModuleHandleA
IsDebuggerPresent
CloseHandle
CreateThread
DisableThreadLibraryCalls
GetModuleFileNameW
FlushFileBuffers
GetFileAttributesW
WriteFile
OutputDebugStringA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
GetLocalTime
GetTickCount
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
GetCurrentProcessId
GetFileAttributesA
GetLastError
GetModuleFileNameA
RtlCaptureContext
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
vcruntime140
__current_exception_context
__current_exception
__std_type_info_destroy_list
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memset
memmove
strstr
wcsstr
strrchr
memchr
__C_specific_handler
memcmp
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_crt_at_quick_exit
_cexit
terminate
_seh_filter_dll
_configure_narrow_argv
_invoke_watson
_initterm_e
_initterm
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_execute_onexit_table
api-ms-win-crt-string-l1-1-0
wcslen
strlen
strncpy
strcpy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
Java_lion_client_NativeBridge_attachAgent
Java_lion_client_NativeBridge_findClassClassLoader
Java_lion_client_NativeBridge_findMinecraftHwnd
Java_lion_client_NativeBridge_findOwnWindowByTitle
Java_lion_client_NativeBridge_getFocusedWindowTitle
Java_lion_client_NativeBridge_getForegroundPid
Java_lion_client_NativeBridge_getWindowRect
Java_lion_client_NativeBridge_isKeyDown
Java_lion_client_NativeBridge_isMinecraftFocused
Java_lion_client_NativeBridge_sendClick
Java_lion_client_NativeBridge_setClickThrough
Name
.text
Size
165KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35207,
count=8, id=260, version=35207,
count=19, id=261, version=35207,
count=6, id=257, version=35207,
count=5, id=257, version=33145,
count=91, id=1, productName=Unmarked objects,
count=4, id=261, version=35222,
count=1, id=256, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,