ANY.RUN Interactive Sandbox
- Full browser-level visibility into phishing
- Huge database of samples and IOCs
- Interactivity in a safe environment
- Actionable Tier 1 reports
Get full visibility into malware and phishing behavior in a safe environment.
| File name: | AstraWare-v5.0.1.jar |
| Full analysis: | https://app.any.run/tasks/eee5b22b-5326-4422-8cdd-c6bd9e758d16 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | May 04, 2026, 22:57:07 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=deflate |
| MD5: | 398BCD86F704A10D7F56DF680F508D0F |
| SHA1: | A229BD16BC55DF23A47F93C4DF7E275125E202D8 |
| SHA256: | 7B9CD79149F73724D74180D142A292334335EA980BFED7F3A86FFD7B4F795A89 |
| SSDEEP: | 98304:udnxsR6PWDkQy9q9Cu93+NOu76oIH1YB5kxLUqFctjejVKshZoAebz6ZIs7lI8tV:65QmpywNwXkk |
MALICIOUS
Stealers network behavior
- javaw.exe (PID: 7268)
WEEDHACK has been detected (SURICATA)
- javaw.exe (PID: 7268)
Known privilege escalation attack
- dllhost.exe (PID: 1312)
SUSPICIOUS
Application launched itself
- javaw.exe (PID: 8020)
Executable content was dropped or overwritten
- javaw.exe (PID: 7268)
Used cmstp for execute code hidden within an inf file
- javaw.exe (PID: 7268)
Runs shell command (SCRIPT)
- wscript.exe (PID: 7336)
INFO
Create files in a temporary directory
- javaw.exe (PID: 8020)
- javaw.exe (PID: 7268)
- javaw.exe (PID: 5604)
Checks supported languages
- javaw.exe (PID: 8020)
- javaw.exe (PID: 7268)
- javaw.exe (PID: 5604)
Reads Environment values
- javaw.exe (PID: 8020)
- javaw.exe (PID: 7268)
- javaw.exe (PID: 5604)
Reads CPU info
- javaw.exe (PID: 8020)
- javaw.exe (PID: 7268)
- javaw.exe (PID: 5604)
Reads the machine GUID from the registry
- javaw.exe (PID: 7268)
Reads the computer name
- javaw.exe (PID: 7268)
Creates files or folders in the user directory
- javaw.exe (PID: 7268)
Disables trace logs
- cmstp.exe (PID: 4384)
- dllhost.exe (PID: 1312)
Checks transactions between databases Windows and Oracle
- cmstp.exe (PID: 4384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .jar | | | Java Archive (78.3) |
|---|---|---|
| .zip | | | ZIP compressed archive (21.6) |
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2026:04:19 00:06:56 |
| ZipCRC: | 0x6750e743 |
| ZipCompressedSize: | 1446713 |
| ZipUncompressedSize: | 1449906 |
| ZipFileName: | guiicon.png |
Total processes
138
Monitored processes
7
Malicious processes
3
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 144 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1312 | C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\System32\dllhost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4384 | cmstp.exe /au "C:\Users\admin\AppData\Local\Temp\\ldjkvgplej.acdm" | C:\Windows\System32\cmstp.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Connection Manager Profile Installer Exit code: 0 Version: 7.2.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5604 | "C:\Program Files\Java\jdk-25.0.2\bin\javaw.exe" -cp "C:\Users\admin\AppData\Local\Temp\elevator.jar" com.github.Main b64:eyJleGVjdXRpb25FbnZpcm9ubWVudCI6IkRvdWJsZUNsaWNrIiwidXNlcklkIjoiM2ZmNTExYTUtNGRiZS00Njg1LTlhYjQtYjJjYmI4MWU1YTI5In0= | C:\Program Files\Java\jdk-25.0.2\bin\javaw.exe | — | wscript.exe | |||||||||||
User: admin Company: N/A Integrity Level: HIGH Description: Java(TM) Platform SE binary Exit code: 1 Version: 25.0.2.0 Modules
| |||||||||||||||
| 7268 | "C:\Program Files\Java\jdk-25.0.2\bin\javaw.exe" -jar C:\Users\admin\Desktop\AstraWare-v5.0.1.jar --jw | C:\Program Files\Java\jdk-25.0.2\bin\javaw.exe | javaw.exe | ||||||||||||
User: admin Company: N/A Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 25.0.2.0 Modules
| |||||||||||||||
| 7336 | wscript //B C:\Users\admin\AppData\Local\Temp\\elv.vbs | C:\Windows\System32\wscript.exe | — | dllhost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 8020 | "C:\Program Files\Java\jdk-25.0.2\bin\javaw.exe" -jar C:\Users\admin\Desktop\AstraWare-v5.0.1.jar | C:\Program Files\Java\jdk-25.0.2\bin\javaw.exe | — | explorer.exe | |||||||||||
User: admin Company: N/A Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 25.0.2.0 Modules
| |||||||||||||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
3
Suspicious files
2
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7268 | javaw.exe | C:\Users\admin\AppData\Local\Temp\lib6235441902174627366.tmp | executable | |
MD5:3FE0E561EE3DE87C8A786DCB2B0C3D79 | SHA256:B3E8C2DC252BF68E47EC2AB052592D159468F11CE9851B3DE9951D17AA24104A | |||
| 7268 | javaw.exe | C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\83aa4cc77f591dfc2374580bbd95f6ba_bb926e54-e3ca-40fd-ae90-2764341e7792 | binary | |
MD5:C8366AE350E7019AEFC9D1E6E6A498C6 | SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238 | |||
| 7268 | javaw.exe | C:\Users\admin\AppData\Local\Temp\elevator.jar | compressed | |
MD5:1C983AE44D4E31FB1A3DCAEDCB5D462E | SHA256:E7D1346153B49CE403687BBD0DDBF1DB63DE6808D64EA2812EA48EF0CFE7CF2A | |||
| 7268 | javaw.exe | C:\Users\admin\AppData\Local\Temp\elv.vbs | text | |
MD5:85E4F5253D6DA5D86139566C1D53CB86 | SHA256:E1A102EB19DEAB4EBE32451E4948974FF6FBF241C16689EE93B305F952982802 | |||
| 7268 | javaw.exe | C:\Users\admin\AppData\Local\Temp\ldjkvgplej.acdm | text | |
MD5:A18FB0BBE3E67074CA6D0134C0B7D5F7 | SHA256:FDCEAFE4DCF9CF6D23B2033824275C08EC73D6B01ADC644416E43ECCA94C89C9 | |||
| 7268 | javaw.exe | C:\Users\admin\AppData\Local\Temp\jna-1777935446281\jnidispatch.dll | executable | |
MD5:2D2475F1F026DD54E9F3E787AE4F81DA | SHA256:5A7FF949F6D93D86491EB5B26B1CFC60051168A60622650224B89995AC420023 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
26
DNS requests
9
Threats
6
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6260 | svchost.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | US | binary | 814 b | whitelisted |
— | — | GET | 200 | 1.0.0.1:443 | https://cloudflare-dns.com/dns-query?name=eth.llamarpc.com&type=A | AU | text | 262 b | unknown |
144 | slui.exe | POST | 500 | 48.192.1.65:443 | https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail | US | xml | 512 b | whitelisted |
7268 | javaw.exe | GET | 200 | 1.0.0.1:443 | https://cloudflare-dns.com/dns-query?name=whpayment.ru&type=A | AU | text | 190 b | unknown |
— | — | GET | 200 | 1.0.0.1:443 | https://cloudflare-dns.com/dns-query?name=eth.llamarpc.com&type=A | AU | text | 264 b | unknown |
3280 | svchost.exe | GET | 200 | 23.59.18.102:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.3.crl | US | binary | 400 b | whitelisted |
7268 | javaw.exe | GET | 200 | 1.0.0.1:443 | https://cloudflare-dns.com/dns-query?name=whpayment.ru&type=A | AU | text | 190 b | unknown |
3280 | svchost.exe | GET | 200 | 23.59.18.102:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl | US | binary | 814 b | whitelisted |
3280 | svchost.exe | GET | 200 | 23.59.18.102:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl | US | binary | 813 b | whitelisted |
3280 | svchost.exe | GET | 200 | 23.59.18.102:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl | US | binary | 400 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
8028 | slui.exe | 48.192.1.65:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
6260 | svchost.exe | 184.24.77.37:80 | crl.microsoft.com | AKAMAI-ASN1 | NL | whitelisted |
6260 | svchost.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | US | whitelisted |
5276 | MoUsoCoreWorker.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | US | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5276 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6260 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
activation-v2.sls.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
cloudflare-dns.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2232 | svchost.exe | Misc activity | INFO [ANY.RUN] Cloudflare DNS-over-HTTPS service requested (cloudflare-dns .com) |
7268 | javaw.exe | Misc activity | ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI) |
7268 | javaw.exe | A Network Trojan was detected | STEALER WeedHack TLS activity observed |
— | — | A Network Trojan was detected | ET MALWARE EtherHiding Exfil M2 |
— | — | Misc activity | INFO [ANY.RUN] DDoS-Guard Hosted Web Content observed |
— | — | A Network Trojan was detected | ET MALWARE EtherHiding Exfil M2 |