| File name: | RuneLite.jar |
| Full analysis: | https://app.any.run/tasks/2f9149dc-4f41-42ea-836e-2b254c419ae7 |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | September 17, 2018, 02:13:08 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/java-archive |
| File info: | Java archive data (JAR) |
| MD5: | F5EDF5D3B707D5C59974CFC6A07951E9 |
| SHA1: | 30807A33B71CE7B67C8FEC5EFF9FB3C8B52B64B0 |
| SHA256: | 6247726793E23829E78226B516EC19FDE2F685B11634AB3B185C07C52F5F8094 |
| SSDEEP: | 98304:tGWGy22SPBNBYIY7JYHvvlyVW4UgA1wb0:tjy2SPBlYaPv500 |
| .maff | | | Mozilla Archive Format (gen) (63.6) |
|---|---|---|
| .zip | | | ZIP compressed archive (36.3) |
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0808 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2018:09:02 12:46:12 |
| ZipCRC: | 0x9a95955c |
| ZipCompressedSize: | 65 |
| ZipUncompressedSize: | 69 |
| ZipFileName: | META-INF/MANIFEST.MF |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1028 | "C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -cp C:\Users\admin\.runelite\repository2\client-1.4.17.1.jar;C:\Users\admin\.runelite\repository2\slf4j-api-1.7.25.jar;C:\Users\admin\.runelite\repository2\logback-classic-1.2.3.jar;C:\Users\admin\.runelite\repository2\logback-core-1.2.3.jar;C:\Users\admin\.runelite\repository2\jopt-simple-5.0.1.jar;C:\Users\admin\.runelite\repository2\guava-23.2-jre.jar;C:\Users\admin\.runelite\repository2\jsr305-1.3.9.jar;C:\Users\admin\.runelite\repository2\error_prone_annotations-2.0.18.jar;C:\Users\admin\.runelite\repository2\j2objc-annotations-1.1.jar;C:\Users\admin\.runelite\repository2\animal-sniffer-annotations-1.14.jar;C:\Users\admin\.runelite\repository2\guice-4.1.0-no_aop.jar;C:\Users\admin\.runelite\repository2\javax.inject-1.jar;C:\Users\admin\.runelite\repository2\aopalliance-1.0.jar;C:\Users\admin\.runelite\repository2\gson-2.8.5.jar;C:\Users\admin\.runelite\repository2\substance-8.0.02.jar;C:\Users\admin\.runelite\repository2\trident-1.5.00.jar;C:\Users\admin\.runelite\repository2\commons-text-1.2.jar;C:\Users\admin\.runelite\repository2\commons-lang3-3.7.jar;C:\Users\admin\.runelite\repository2\runelite-api-1.4.17.1.jar;C:\Users\admin\.runelite\repository2\runescape-api-1.4.17.1.jar;C:\Users\admin\.runelite\repository2\injected-client-1.4.17.1.jar;C:\Users\admin\.runelite\repository2\http-api-1.4.17.1.jar;C:\Users\admin\.runelite\repository2\okhttp-3.7.0.jar;C:\Users\admin\.runelite\repository2\okio-1.12.0.jar;C:\Users\admin\.runelite\repository2\commons-csv-1.4.jar;C:\Users\admin\.runelite\repository2\discord-1.0.jar;C:\Users\admin\.runelite\repository2\jna-4.5.1.jar -Xmx512m -Xss2m -XX:CompileThreshold=1500 -Xincgc -XX:+UseConcMarkSweepGC -XX:+UseParNewGC -Djna.nosys=true -Dsun.java2d.noddraw=false -Dsun.java2d.opengl=false -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -Drunelite.launcher.version=1.6.1-SNAPSHOT net.runelite.client.RuneLite | C:\Program Files\Java\jre1.8.0_92\bin\java.exe | javaw.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 Modules
| |||||||||||||||
| 1908 | C:\Users\admin\AppData\Roaming\clientNull64.exe | C:\Users\admin\AppData\Roaming\clientNull64.exe | — | javaw.exe | |||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
| |||||||||||||||
| 2780 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\RuneLite.jar" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | explorer.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 Modules
| |||||||||||||||
| 3196 | C:\Users\admin\AppData\Roaming\clientNull.exe | C:\Users\admin\AppData\Roaming\clientNull.exe | — | javaw.exe | |||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
| |||||||||||||||
| 3964 | C:\Users\admin\AppData\Roaming\clientNull64.exe | C:\Windows\System32\help.exe | clientNull64.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Command Line Help Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3968 | C:\Users\admin\AppData\Roaming\clientNull.exe | C:\Windows\System32\help.exe | clientNull.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Command Line Help Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| (PID) Process: | (2780) javaw.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: javaw.exe | |||
| (PID) Process: | (1028) java.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: java.exe | |||
| (PID) Process: | (1028) java.exe | Key: | HKEY_CLASSES_ROOT\discord-409416265891971072 |
| Operation: | write | Name: | |
Value: URL:Run game 409416265891971072 protocol | |||
| (PID) Process: | (1028) java.exe | Key: | HKEY_CLASSES_ROOT\discord-409416265891971072 |
| Operation: | write | Name: | URL Protocol |
Value: | |||
| (PID) Process: | (1028) java.exe | Key: | HKEY_CLASSES_ROOT\discord-409416265891971072\DefaultIcon |
| Operation: | write | Name: | |
Value: C:\Program Files\Java\jre1.8.0_92\bin\java.exe | |||
| (PID) Process: | (1028) java.exe | Key: | HKEY_CLASSES_ROOT\discord-409416265891971072\shell\open\command |
| Operation: | write | Name: | |
Value: C:\Program Files\Java\jre1.8.0_92\bin\java.exe | |||
| (PID) Process: | (3968) help.exe | Key: | HKEY_CURRENT_USER\Software\Remcos-6HE0XU |
| Operation: | write | Name: | exepath |
Value: 612511D384BFD073C601EB522FB15C6BE73ACC45779A3AB31BA5FC0468311E8471C5BD323ECA5C71C18EE235F2082D29298678903DF449AB9511 | |||
| (PID) Process: | (3968) help.exe | Key: | HKEY_CURRENT_USER\Software\Remcos-6HE0XU |
| Operation: | write | Name: | lic |
Value: F8D6BAB3634D6C10651960716204A09C | |||
| (PID) Process: | (3964) help.exe | Key: | HKEY_CURRENT_USER\Software\comesnGo-7P3I86 |
| Operation: | write | Name: | exepath |
Value: 5B68BFBACC52CB1FDAEB46BC299292B36C8B457BD04083F16EF223E23E07A641C42A12264A40E250AD1BBF9E2C625F9104BC07EB7483C25A7FF4 | |||
| (PID) Process: | (3964) help.exe | Key: | HKEY_CURRENT_USER\Software\comesnGo-7P3I86 |
| Operation: | write | Name: | lic |
Value: 679D3726C7FB319BFE2C3187137C2516 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2780 | javaw.exe | C:\Users\admin\AppData\Roaming\clientNull.exe | — | |
MD5:— | SHA256:— | |||
| 2780 | javaw.exe | C:\Users\admin\AppData\Roaming\clientNull64.exe | — | |
MD5:— | SHA256:— | |||
| 2780 | javaw.exe | C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp | text | |
MD5:— | SHA256:— | |||
| 2780 | javaw.exe | C:\Users\admin\AppData\Roaming\clientNull.zip | compressed | |
MD5:— | SHA256:— | |||
| 2780 | javaw.exe | C:\Users\admin\.runelite\repository2\client-1.4.17.1.jar | compressed | |
MD5:— | SHA256:— | |||
| 2780 | javaw.exe | C:\Users\admin\AppData\Roaming\clientNull64.zip | compressed | |
MD5:— | SHA256:— | |||
| 2780 | javaw.exe | C:\Users\admin\.runelite\repository2\slf4j-api-1.7.25.jar | compressed | |
MD5:CAAFE376AFB7086DCBEE79F780394CA3 | SHA256:18C4A0095D5C1DA6B817592E767BB23D29DD2F560AD74DF75FF3961DBDE25B79 | |||
| 2780 | javaw.exe | C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2f | dbf | |
MD5:C8366AE350E7019AEFC9D1E6E6A498C6 | SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238 | |||
| 2780 | javaw.exe | C:\Users\admin\.runelite\repository2\jopt-simple-5.0.1.jar | java | |
MD5:C5ED11011FDEAC9EC50826801D5ADCBB | SHA256:9F0C8D50FA4B79B6FF1502DBEC8502179D6B9497CACBE17A13074001AED537EC | |||
| 2780 | javaw.exe | C:\Users\admin\.runelite\repository2\jsr305-1.3.9.jar | java | |
MD5:1D5A772E400B04BB67A7EF4A0E0996D8 | SHA256:905721A0EEA90A81534ABB7EE6EF4EA2E5E645FA1DEF0A5CD88402DF1B46C9ED | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2780 | javaw.exe | GET | 200 | 172.64.198.2:80 | http://repo.runelite.net/net/runelite/client/1.4.17.1/client-1.4.17.1.jar | US | compressed | 2.39 Mb | suspicious |
2780 | javaw.exe | GET | 200 | 172.64.199.2:80 | http://mvn.runelite.net/com/google/guava/guava/23.2-jre/guava-23.2-jre.jar | US | java | 2.53 Mb | suspicious |
2780 | javaw.exe | GET | 200 | 172.64.199.2:80 | http://mvn.runelite.net/net/sf/jopt-simple/jopt-simple/5.0.1/jopt-simple-5.0.1.jar | US | java | 76.9 Kb | suspicious |
2780 | javaw.exe | GET | 200 | 172.64.199.2:80 | http://mvn.runelite.net/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar | US | compressed | 460 Kb | suspicious |
2780 | javaw.exe | GET | 200 | 172.64.199.2:80 | http://mvn.runelite.net/org/slf4j/slf4j-api/1.7.25/slf4j-api-1.7.25.jar | US | compressed | 40.2 Kb | suspicious |
2780 | javaw.exe | GET | 200 | 172.64.199.2:80 | http://mvn.runelite.net/aopalliance/aopalliance/1.0/aopalliance-1.0.jar | US | compressed | 4.36 Kb | suspicious |
2780 | javaw.exe | GET | 200 | 172.64.199.2:80 | http://mvn.runelite.net/com/google/code/findbugs/jsr305/1.3.9/jsr305-1.3.9.jar | US | java | 32.2 Kb | suspicious |
2780 | javaw.exe | GET | 200 | 172.64.199.2:80 | http://mvn.runelite.net/com/google/code/gson/gson/2.8.5/gson-2.8.5.jar | US | compressed | 235 Kb | suspicious |
2780 | javaw.exe | GET | 200 | 172.64.199.2:80 | http://mvn.runelite.net/org/codehaus/mojo/animal-sniffer-annotations/1.14/animal-sniffer-annotations-1.14.jar | US | compressed | 3.40 Kb | suspicious |
2780 | javaw.exe | GET | 200 | 172.64.199.2:80 | http://mvn.runelite.net/com/google/errorprone/error_prone_annotations/2.0.18/error_prone_annotations-2.0.18.jar | US | compressed | 11.7 Kb | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1028 | java.exe | 91.235.140.148:80 | oldschool.runescape.com | Level 3 Communications, Inc. | GB | suspicious |
1028 | java.exe | 104.244.46.199:443 | pbs.twimg.com | Twitter Inc. | US | unknown |
1028 | java.exe | 217.163.53.218:80 | oldschool33a.runescape.com | Level 3 Communications, Inc. | GB | unknown |
1028 | java.exe | 217.163.53.218:43594 | oldschool33a.runescape.com | Level 3 Communications, Inc. | GB | unknown |
3964 | help.exe | 164.132.90.226:55420 | secure100kserver.com | OVH SAS | GB | malicious |
1028 | java.exe | 172.64.199.2:443 | static.runelite.net | Cloudflare Inc | US | shared |
3968 | help.exe | 154.16.137.160:55719 | ezpz1.xyz | Cascade Divide Colo, Inc. | US | unknown |
— | — | 217.163.53.218:43594 | oldschool33a.runescape.com | Level 3 Communications, Inc. | GB | unknown |
2780 | javaw.exe | 172.64.199.2:80 | static.runelite.net | Cloudflare Inc | US | shared |
2780 | javaw.exe | 172.64.198.2:80 | static.runelite.net | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
|---|---|---|
static.runelite.net |
| suspicious |
ultrabot.org |
| malicious |
repo.runelite.net |
| suspicious |
mvn.runelite.net |
| suspicious |
oldschool.runescape.com |
| suspicious |
oldschool33a.runescape.com |
| unknown |
api.runelite.net |
| suspicious |
pbs.twimg.com |
| whitelisted |
secure100kserver.com |
| malicious |
ezpz1.xyz |
| malicious |
PID | Process | Class | Message |
|---|---|---|---|
3964 | help.exe | A Network Trojan was detected | ET TROJAN Remcos RAT Checkin 23 |