| File name: | Salwyrr Minecraft Launcher 4.jar |
| Full analysis: | https://app.any.run/tasks/c2d625b5-2136-4f40-b35d-e41a28f71bf5 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | January 26, 2022, 16:14:36 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract |
| MD5: | 4B24B17D43E78C5636C951F6423DB15C |
| SHA1: | 735E491608AA06ACFC171A65EDF73A09FD7A5A0C |
| SHA256: | 361AA5684BB79D8B2494BCD51431161811C498884AF1D03EF44815B6E1D4A606 |
| SSDEEP: | 12288:nTdE0zgQ91Sku7Jgp+4C0xQZIKdHVr5ww7caw+O7Un:Tdb+mgWQZIKnuNaMUn |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads the computer name
- javaw.exe (PID: 2168)
- javaw.exe (PID: 540)
Checks supported languages
- javaw.exe (PID: 2168)
- javaw.exe (PID: 540)
- cmd.exe (PID: 2436)
Creates files in the program directory
- javaw.exe (PID: 2168)
Creates files in the user directory
- javaw.exe (PID: 2168)
- javaw.exe (PID: 540)
Starts CMD.EXE for commands execution
- javaw.exe (PID: 2168)
Uses ICACLS.EXE to modify access control list
- javaw.exe (PID: 2168)
Executes JAVA applets
- cmd.exe (PID: 2436)
Drops a file with a compile date too recent
- javaw.exe (PID: 540)
Executable content was dropped or overwritten
- javaw.exe (PID: 540)
INFO
Checks supported languages
- icacls.exe (PID: 3464)
- explorer.exe (PID: 128)
Reads the computer name
- icacls.exe (PID: 3464)
- explorer.exe (PID: 128)
Manual execution by user
- explorer.exe (PID: 128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .jar | | | Java Archive (78.3) |
|---|---|---|
| .zip | | | ZIP compressed archive (21.6) |
EXIF
ZIP
| ZipFileName: | META-INF/MANIFEST.MF |
|---|---|
| ZipUncompressedSize: | 69 |
| ZipCompressedSize: | 64 |
| ZipCRC: | 0xa8e9cff2 |
| ZipModifyDate: | 2021:11:08 09:53:12 |
| ZipCompression: | Deflated |
| ZipBitFlag: | - |
| ZipRequiredVersion: | 10 |
Total processes
44
Monitored processes
5
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 128 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 540 | "C:\Program Files\Java\jre1.8.0_271\bin\javaw" -Xmx512m -cp "C:\Users\admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr | C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe | cmd.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.2710.9 Modules
| |||||||||||||||
| 2168 | "C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\Desktop\Salwyrr Minecraft Launcher 4.jar" | C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe | Explorer.EXE | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.2710.9 Modules
| |||||||||||||||
| 2436 | cmd.exe /c ""C:\Program Files\Java\jre1.8.0_271\bin\javaw" -Xmx512m -cp "C:\Users\admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr " | C:\Windows\system32\cmd.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3464 | C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M | C:\Windows\system32\icacls.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 106
Read events
1 104
Write events
2
Delete events
0
Modification events
| (PID) Process: | (2168) javaw.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: javaw.exe | |||
| (PID) Process: | (540) javaw.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: javaw.exe | |||
Executable files
20
Suspicious files
74
Text files
37
Unknown types
7
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2168 | javaw.exe | C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamp | text | |
MD5:— | SHA256:— | |||
| 2168 | javaw.exe | C:\Users\admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar | compressed | |
MD5:— | SHA256:— | |||
| 2168 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio7321373779663177646.tmp | image | |
MD5:59831FDF4453BEA0A039B813E9D8236D | SHA256:106017ADE1A102169CC96DBEE614BC56DF5F60A2826653BCA223AB8423113CE0 | |||
| 540 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio7233720392805528474.tmp | image | |
MD5:0340915C04AA1E91BFE012F0E067AFEF | SHA256:51A95FDB35E34C5A930743E7C5B1E4EF33800633B13E063C4324910BBF2F9D8F | |||
| 540 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio6656411578733555852.tmp | image | |
MD5:200CF1EE71C4AA52DAFD85CF9250404E | SHA256:A5C701AA44525765388CB728E0FF6796428A00CA87DA22A55C8096EEB34C87DC | |||
| 540 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio2762898428188208043.tmp | image | |
MD5:59831FDF4453BEA0A039B813E9D8236D | SHA256:106017ADE1A102169CC96DBEE614BC56DF5F60A2826653BCA223AB8423113CE0 | |||
| 2168 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio4795937297245348630.tmp | image | |
MD5:268C8630442CA5D8045693D60A2BEFDA | SHA256:42207FE6936597F4F52B4296072333D596467C2069FA2AFAC7A24B8CDE3BEB1B | |||
| 540 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio57970700915254631.tmp | image | |
MD5:088562DC34A56FB7AADF6BB7AD63C016 | SHA256:DB6C6FF6BC4684006F2583D8F489E2FDD1F08813F3EC4D7DF30DB362598BE306 | |||
| 540 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio677766191428561483.tmp | image | |
MD5:4745EC99629400489314B18C3E6BEAB4 | SHA256:1FE5089A946F5F0ED8C1FA08B6DDC60B720C35A5DD7708EF4B48B00129A08B01 | |||
| 540 | javaw.exe | C:\Users\admin\AppData\Local\Temp\imageio2867663345979726480.tmp | image | |
MD5:B4D8D88863849713FDB1687E36DBF404 | SHA256:014366D7C75963CEF3CF979094173354E3EC48E4D26868B87DCC1C1DE31C7EE8 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
142
TCP/UDP connections
73
DNS requests
2
Threats
171
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
540 | javaw.exe | GET | — | 167.114.173.51:80 | http://167.114.173.51/files-4/files/../versions/1.18.1/libs/jopt-simple-5.0.4.jar | CA | — | — | malicious |
540 | javaw.exe | GET | — | 167.114.173.51:80 | http://167.114.173.51/files-4/files/../versions/1.18.1/natives/libjcocoa.dylib | CA | — | — | malicious |
540 | javaw.exe | GET | — | 167.114.173.51:80 | http://167.114.173.51/files-4/files/../versions/1.18.1/natives/libjcocoa.dylib | CA | — | — | malicious |
540 | javaw.exe | GET | — | 167.114.173.51:80 | http://167.114.173.51/files-4/files/../versions/1.18.1/natives/libjcocoa.dylib | CA | — | — | malicious |
540 | javaw.exe | GET | — | 167.114.173.51:80 | http://167.114.173.51/files-4/files/../versions/1.18.1/natives/libjcocoa.dylib | CA | — | — | malicious |
2168 | javaw.exe | POST | 200 | 167.114.173.51:80 | http://api.salwyrr.fr/bootstrap4/ | CA | text | 54 b | malicious |
2168 | javaw.exe | GET | 200 | 167.114.173.51:80 | http://api.salwyrr.fr/bootstrap4/files/launcher.jar | CA | compressed | 3.14 Mb | malicious |
540 | javaw.exe | GET | 200 | 167.114.173.51:80 | http://167.114.173.51/files-4/update.php?bits=32&cef=win32&v=1.18.1 | CA | text | 10.2 Kb | malicious |
540 | javaw.exe | GET | 206 | 167.114.173.51:80 | http://167.114.173.51/files-4/files/../versions/1.18.1/libs/jopt-simple-5.0.4.jar | CA | binary | 19.0 Kb | malicious |
540 | javaw.exe | GET | 206 | 167.114.173.51:80 | http://167.114.173.51/files-4/files/../versions/1.18.1/libs/jopt-simple-5.0.4.jar | CA | java | 19.0 Kb | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2168 | javaw.exe | 167.114.173.51:80 | api.salwyrr.fr | OVH SAS | CA | malicious |
540 | javaw.exe | 62.210.119.175:443 | www.salwyrr.com | Online S.a.s. | FR | unknown |
540 | javaw.exe | 167.114.173.51:80 | api.salwyrr.fr | OVH SAS | CA | malicious |
— | — | 167.114.173.51:80 | api.salwyrr.fr | OVH SAS | CA | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
api.salwyrr.fr |
| malicious |
www.salwyrr.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potentially Bad Traffic | ET POLICY Vulnerable Java Version 1.8.x Detected |
— | — | Potentially Bad Traffic | ET POLICY Vulnerable Java Version 1.8.x Detected |
— | — | Potentially Bad Traffic | ET CURRENT_EVENTS SUSPICIOUS JAR Download by Java UA with non JAR EXT matches various EKs |
— | — | A Network Trojan was detected | ET INFO JAVA - Java Archive Download By Vulnerable Client |
— | — | Potentially Bad Traffic | ET INFO Java .jar request to dotted-quad domain |
— | — | Potentially Bad Traffic | ET INFO Java .jar request to dotted-quad domain |
— | — | A Network Trojan was detected | ET INFO JAVA - Java Archive Download By Vulnerable Client |
— | — | Potentially Bad Traffic | ET INFO JAR Size Under 30K Size - Potentially Hostile |
— | — | Potentially Bad Traffic | ET INFO Dotted Quad Host ZIP Request |
— | — | Potentially Bad Traffic | ET INFO Dotted Quad Host ZIP Request |
1 ETPRO signatures available at the full report