analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

vmd-gnu.jar

Full analysis: https://app.any.run/tasks/b3b8e086-3ee5-4b55-b8d6-0c7cda293194
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: October 04, 2022, 23:35:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

0DB41B2AD1701C8DD21BF82A7BA0D1A2

SHA1:

624837A950F42C8A48E73B9B5EA1080F0DBA1576

SHA256:

72E7EF3114E7796333D3BEFBE5F5D1F689BD02810B1DC9765CD07C50613FA0E5

SSDEEP:

196608:VV2hYpwBzhF5EXbhkJu3xPowNDWHTc8z2rC:V0huwBdF5Xo3x7WRz2e

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • javaw.exe (PID: 3848)
      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Writes to a start menu file

      • javaw.exe (PID: 3848)

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 3848)
      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Stealing of credential data

      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Steals credentials from Web Browsers

      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Actions looks like stealing of personal data

      • java.exe (PID: 3284)
      • java.exe (PID: 1956)

  • SUSPICIOUS

    • Uses ICACLS.EXE to modify access control list

      • javaw.exe (PID: 3848)

    • Checks supported languages

      • javaw.exe (PID: 3848)
      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Creates files in the program directory

      • javaw.exe (PID: 3848)

    • Executable content was dropped or overwritten

      • javaw.exe (PID: 3848)
      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Reads the computer name

      • javaw.exe (PID: 3848)
      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Drops a file with a compile date too recent

      • javaw.exe (PID: 3848)
      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Creates files in the user directory

      • javaw.exe (PID: 3848)

    • Executes JAVA applets

      • javaw.exe (PID: 3848)

    • Reads the cookies of Google Chrome

      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

    • Reads the cookies of Mozilla Firefox

      • java.exe (PID: 1956)
      • java.exe (PID: 3284)

  • INFO

    • Reads the computer name

      • icacls.exe (PID: 2204)

    • Checks supported languages

      • icacls.exe (PID: 2204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jar | Java Archive (56.8)
.zip | ZIP compressed archive (15.6)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe icacls.exe no specs java.exe java.exe

Process information

PID
CMD
Path
Indicators
Parent process
3848"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\vmd-gnu.jar"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe
Explorer.EXE
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2204C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\system32\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\icacls.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
1956"C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\2966213277645464574.tmpC:\Program Files\Java\jre1.8.0_271\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\java\jre1.8.0_271\bin\java.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3284"C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -jar C:\Users\admin\AppData\Local\Temp\7202486038657797063.tmpC:\Program Files\Java\jre1.8.0_271\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\java.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 162
Read events
2 162
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
5
Text files
1
Unknown types
10

Dropped files

PID
Process
Filename
Type
3848javaw.exeC:\Users\admin\AppData\Local\Temp\2966213277645464574.tmpcompressed
MD5:4A21CAE60FEF3D0D4FCCB319A282C7C0
SHA256:AF8B6AC45918BC87D2A164FAE888DAB6E623327CBA7C2409E4D0EF1DDE8D1793
3848javaw.exeC:\Users\admin\AppData\Local\Temp\7202486038657797063.tmpcompressed
MD5:4A21CAE60FEF3D0D4FCCB319A282C7C0
SHA256:AF8B6AC45918BC87D2A164FAE888DAB6E623327CBA7C2409E4D0EF1DDE8D1793
3848javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\javaw.jarcompressed
MD5:0DB41B2AD1701C8DD21BF82A7BA0D1A2
SHA256:72E7EF3114E7796333D3BEFBE5F5D1F689BD02810B1DC9765CD07C50613FA0E5
3848javaw.exeC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamptext
MD5:D6A7A799197293C504541AFCA149CAFD
SHA256:78E79DA7EC5B68CCC0EA0CF155AC61611321DF8684E3707AA68AF4ABACA49194
1956java.exeC:\Users\admin\AppData\Local\Temp\1329E54635B.dbsqlite
MD5:23D08A78BC908C0B29E9800D3D5614E7
SHA256:F6BD7DF5DFAE9FD88811A807DBA14085E00C1B5A6D7CC3D06CC68F6015363D59
1956java.exeC:\Users\admin\AppData\Local\Temp\1329E54635B.db-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
1956java.exeC:\Users\admin\AppData\Local\Temp\132912021E9.dbsqlite
MD5:D02907BE1C995E1E51571EEDB82FA281
SHA256:2189977F6EA58BDAD5883720B099E12B869F223FB9B18AC40E7D37C5954A55DD
3284java.exeC:\Users\admin\AppData\Local\Temp\13A86AF8EE9.dbsqlite
MD5:23D08A78BC908C0B29E9800D3D5614E7
SHA256:F6BD7DF5DFAE9FD88811A807DBA14085E00C1B5A6D7CC3D06CC68F6015363D59
3848javaw.exeC:\Users\admin\AppData\Local\Temp\jna-92668751\jna4975666686769459856.dllexecutable
MD5:44CEE45EC3A7AECADA1E95C902133989
SHA256:775A81FAF08E0E7870692ED268F8616E770F6364141FFA8CEDBDF8E8C7CFBE7A
3284java.exeC:\Users\admin\AppData\Local\Temp\13A6AB84C71.dbsqlite
MD5:B8E63E7225C9F4E0A81371F29D6456D8
SHA256:35A6919CE60EA8E0A44934F8B267BDE2C5A063C2E32F22D34724F168C43150C8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
10
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/version
unknown
text
3 b
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/version
unknown
text
3 b
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/qqqqqqqqq
unknown
compressed
6.60 Mb
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/version
unknown
text
3 b
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/qqqqqqqqq
unknown
compressed
6.60 Mb
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/version
unknown
text
3 b
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/version
unknown
text
3 b
suspicious
3848
javaw.exe
GET
200
185.248.140.101:80
http://t23e7v6uz8idz87ehugwq.skyrage.de/version
unknown
text
3 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3848
javaw.exe
171.22.30.117:17929
qw3e1ee12e9hzheu9h1912hew1sh12uw9.skyrage.de
Delis LLC
US
unknown
3848
javaw.exe
185.248.140.101:80
t23e7v6uz8idz87ehugwq.skyrage.de
IP-Projects GmbH & Co. KG
DE
suspicious

DNS requests

Domain
IP
Reputation
qw3e1ee12e9hzheu9h1912hew1sh12uw9.skyrage.de
  • 171.22.30.117
unknown
t23e7v6uz8idz87ehugwq.skyrage.de
  • 185.248.140.101
suspicious

Threats

PID
Process
Class
Message
3848
javaw.exe
Potentially Bad Traffic
ET POLICY Vulnerable Java Version 1.8.x Detected
3848
javaw.exe
Potentially Bad Traffic
ET POLICY Vulnerable Java Version 1.8.x Detected
3848
javaw.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
3848
javaw.exe
Potentially Bad Traffic
ET CURRENT_EVENTS SUSPICIOUS JAR Download by Java UA with non JAR EXT matches various EKs
3848
javaw.exe
A Network Trojan was detected
ET INFO JAVA - Java Archive Download By Vulnerable Client
3848
javaw.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
3848
javaw.exe
Potentially Bad Traffic
ET CURRENT_EVENTS SUSPICIOUS JAR Download by Java UA with non JAR EXT matches various EKs
3848
javaw.exe
A Network Trojan was detected
ET INFO JAVA - Java Archive Download By Vulnerable Client
3848
javaw.exe
Potentially Bad Traffic
ET POLICY Vulnerable Java Version 1.8.x Detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
vmd-gnu.jar