File name:

vmd-gnu.jar

Full analysis: https://app.any.run/tasks/b3b8e086-3ee5-4b55-b8d6-0c7cda293194
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: October 04, 2022, 23:35:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

0DB41B2AD1701C8DD21BF82A7BA0D1A2

SHA1:

624837A950F42C8A48E73B9B5EA1080F0DBA1576

SHA256:

72E7EF3114E7796333D3BEFBE5F5D1F689BD02810B1DC9765CD07C50613FA0E5

SSDEEP:

196608:VV2hYpwBzhF5EXbhkJu3xPowNDWHTc8z2rC:V0huwBdF5Xo3x7WRz2e

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • javaw.exe (PID: 3848)
      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Writes to a start menu file

      • javaw.exe (PID: 3848)

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 3848)
      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Steals credentials from Web Browsers

      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Stealing of credential data

      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Actions looks like stealing of personal data

      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

  • SUSPICIOUS

    • Uses ICACLS.EXE to modify access control list

      • javaw.exe (PID: 3848)

    • Creates files in the program directory

      • javaw.exe (PID: 3848)

    • Checks supported languages

      • javaw.exe (PID: 3848)
      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Reads the computer name

      • javaw.exe (PID: 3848)
      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Creates files in the user directory

      • javaw.exe (PID: 3848)

    • Executable content was dropped or overwritten

      • javaw.exe (PID: 3848)
      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Drops a file with a compile date too recent

      • javaw.exe (PID: 3848)
      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Executes JAVA applets

      • javaw.exe (PID: 3848)

    • Reads the cookies of Google Chrome

      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Reads the cookies of Mozilla Firefox

      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

  • INFO

    • Checks supported languages

      • icacls.exe (PID: 2204)

    • Reads the computer name

      • icacls.exe (PID: 2204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jar | Java Archive (56.8)
.zip | ZIP compressed archive (15.6)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe icacls.exe no specs java.exe java.exe

Process information

PID
CMD
Path
Indicators
Parent process
1956"C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\2966213277645464574.tmpC:\Program Files\Java\jre1.8.0_271\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\java\jre1.8.0_271\bin\java.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2204C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\system32\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\icacls.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
3284"C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\7202486038657797063.tmpC:\Program Files\Java\jre1.8.0_271\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\java.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3848"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\vmd-gnu.jar"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe
Explorer.EXE
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 162
Read events
2 162
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
5
Text files
1
Unknown types
10

Dropped files

PID
Process
Filename
Type
3848javaw.exeC:\Users\admin\AppData\Local\Temp\2966213277645464574.tmpcompressed
MD5:—
SHA256:—
3848javaw.exeC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamptext
MD5:—
SHA256:—
3848javaw.exeC:\Users\admin\AppData\Local\Temp\jna-92668751\jna4975666686769459856.dllexecutable
MD5:44CEE45EC3A7AECADA1E95C902133989
SHA256:775A81FAF08E0E7870692ED268F8616E770F6364141FFA8CEDBDF8E8C7CFBE7A
3848javaw.exeC:\Users\admin\AppData\Local\Temp\7202486038657797063.tmpcompressed
MD5:—
SHA256:—
1956java.exeC:\Users\admin\AppData\Local\Temp\1329E54635B.dbsqlite
MD5:23D08A78BC908C0B29E9800D3D5614E7
SHA256:F6BD7DF5DFAE9FD88811A807DBA14085E00C1B5A6D7CC3D06CC68F6015363D59
1956java.exeC:\Users\admin\AppData\Local\Temp\1329FE3600B.dbsqlite
MD5:8BB736AB1E4300EF81B27CDBF26D78B0
SHA256:7059AEA2275152A5390580485A2180143879F721C88A4CB0D7702A832751A952
1956java.exeC:\Users\admin\AppData\Local\Temp\jna-92668751\jna4625763551775548901.dllexecutable
MD5:44CEE45EC3A7AECADA1E95C902133989
SHA256:775A81FAF08E0E7870692ED268F8616E770F6364141FFA8CEDBDF8E8C7CFBE7A
1956java.exeC:\Users\admin\AppData\Local\Temp\13283BEED05.dbsqlite
MD5:B8E63E7225C9F4E0A81371F29D6456D8
SHA256:35A6919CE60EA8E0A44934F8B267BDE2C5A063C2E32F22D34724F168C43150C8
1956java.exeC:\Users\admin\AppData\Local\Temp\sqlite-3.39.2.0-1bf63073-d0ff-4e4a-815e-91766dfb9229-sqlitejdbc.dllexecutable
MD5:8C11DF50CFFAABAB9DF5BFEA2215CFC3
SHA256:F768E20D08945A01C6E97BEC29C7A7DEEC24AEB2ED747CF3CD3C6EDA2BF818D6
1956java.exeC:\Users\admin\AppData\Local\Temp\1327344B616.dbsqlite
MD5:CC104C4E4E904C3AD7AD5C45FBFA7087
SHA256:321BE844CECC903EF1E7F875B729C96BB3ED0D4986314384CD5944A29A670C9B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
10
DNS requests
4
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/version
unknown
text
3 b
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/version
unknown
text
3 b
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/version
unknown
text
3 b
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/version
unknown
text
3 b
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/version
unknown
text
3 b
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/qqqqqqqqq
unknown
compressed
6.60 Mb
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/qqqqqqqqq
unknown
compressed
6.60 Mb
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/version
unknown
text
3 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3848
javaw.exe
185.248.140.101:80
t23e7v6uz8idz87ehugwq.skyrage.de
IP-Projects GmbH & Co. KG
DE
suspicious
3848
javaw.exe
171.22.30.117:17929
qw3e1ee12e9hzheu9h1912hew1sh12uw9.skyrage.de
Delis LLC
US
unknown

DNS requests

Domain
IP
Reputation
qw3e1ee12e9hzheu9h1912hew1sh12uw9.skyrage.de
  • 171.22.30.117
unknown
t23e7v6uz8idz87ehugwq.skyrage.de
  • 185.248.140.101
suspicious

Threats

PID
Process
Class
Message
3848
javaw.exe
Potentially Bad Traffic
ET POLICY Vulnerable Java Version 1.8.x Detected
3848
javaw.exe
Potentially Bad Traffic
ET POLICY Vulnerable Java Version 1.8.x Detected
3848
javaw.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
3848
javaw.exe
Potentially Bad Traffic
ET CURRENT_EVENTS SUSPICIOUS JAR Download by Java UA with non JAR EXT matches various EKs
3848
javaw.exe
A Network Trojan was detected
ET INFO JAVA - Java Archive Download By Vulnerable Client
3848
javaw.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
3848
javaw.exe
Potentially Bad Traffic
ET CURRENT_EVENTS SUSPICIOUS JAR Download by Java UA with non JAR EXT matches various EKs
3848
javaw.exe
A Network Trojan was detected
ET INFO JAVA - Java Archive Download By Vulnerable Client
3848
javaw.exe
Potentially Bad Traffic
ET POLICY Vulnerable Java Version 1.8.x Detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vmd-gnu.jar