File name: | remittance_advice_20191404.jar |
Full analysis: | https://app.any.run/tasks/80728c21-51c4-470f-a952-62c8715b779c |
Verdict: | Malicious activity |
Analysis date: | April 15, 2019, 04:32:00 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/java-archive |
File info: | Java archive data (JAR) |
MD5: | AE72057FC68BEFA6BB1E9179A974E2E8 |
SHA1: | AF856CA5FD33A5E654872A6EEE9BA01001F26693 |
SHA256: | A48D23BD01607165B03E972725C911A9DB37124C0B1AF97697C0CF4DDCB30507 |
SSDEEP: | 3072:dbEnWUmuTBBN1cOOUs20ro064kRftTQxSg8o79WZU5z2zuEWRgABtUbiyPMidfUS:6IOcOE8xMSg9dzoWR/SkiJUOMp3lQ |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | META-INF/MANIFEST.MF |
---|---|
ZipUncompressedSize: | 56 |
ZipCompressedSize: | 58 |
ZipCRC: | 0xf5d282b0 |
ZipModifyDate: | 2019:04:14 21:10:14 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0808 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2720 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\remittance_advice_20191404.jar" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | explorer.exe | |
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 | ||||
2824 | C:\Users\admin\AppData\Local\Temp\7z_12605526030137512125269811374023.exe x C:\Users\admin\AppData\Local\Temp\_12604838084305313796304251685701.tmp -oC:\Users\admin\AppData\Local\Temp -p"bbb6fec5ebef0d936db0b031b7ab19b6" -mmt -aoa -y | C:\Users\admin\AppData\Local\Temp\7z_12605526030137512125269811374023.exe | javaw.exe | |
User: admin Company: Igor Pavlov Integrity Level: MEDIUM Description: 7-Zip Standalone Console Exit code: 0 Version: 17.00 beta | ||||
3664 | C:\Users\admin\AppData\Local\Temp\qealler\python\python.exe C:\Users\admin\AppData\Local\Temp\qealler\qazaqne\main.py all | C:\Users\admin\AppData\Local\Temp\qealler\python\python.exe | — | javaw.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2720 | javaw.exe | C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp | text | |
MD5:B6ECDC6E3D7EE4BADA4126F0DBCF380A | SHA256:3A872B66CB98788F68C6C090350FD56F681CADDEAD4AAADDE8EB376E3E0BE0EB | |||
2824 | 7z_12605526030137512125269811374023.exe | C:\Users\admin\AppData\Local\Temp\qealler\python\Lib\codecs.pyc | pyc | |
MD5:F14AC9D275F386F72C6CB413EFB32980 | SHA256:B573FC673F220FE3B662CF1F5F8B6151A038B7862C72CEBBAE70CAC4E3CCD05A | |||
2824 | 7z_12605526030137512125269811374023.exe | C:\Users\admin\AppData\Local\Temp\qealler\python\DLLs\_socket.pyd | executable | |
MD5:C09B45502B40E17EA85DA99B45C97BB9 | SHA256:67B9DC047566250DA1905751C96208BC78B2D558446E4E447ED32DBFDD399C13 | |||
2720 | javaw.exe | C:\Users\admin\AppData\Local\Temp\_12602651529263051803449807226235.tmp | java | |
MD5:A593CB286E0FCA1CA62E690022C6D918 | SHA256:93B6A8ECB84FE9771584C329D47FF109464D2FF65C88917D7ACFF75C5DDD0912 | |||
2824 | 7z_12605526030137512125269811374023.exe | C:\Users\admin\AppData\Local\Temp\qealler\python\Lib\atexit.pyc | pyc | |
MD5:CAE911E8D78BA1549CBB768EE5E14CF3 | SHA256:5751159915C8BEE646EFFFCDD901C33CE50FD873E267B43139D01083B81B9177 | |||
2720 | javaw.exe | C:\Users\admin\AppData\Local\Temp\7z_12605804482298861263193722721256.dll | executable | |
MD5:2B2EFB5868AF4C7B5A6B869B9750F98A | SHA256:A7AFD601C41DC6BB99F4197DB7165CE417606D22AD226102FBDEF8911121BA54 | |||
2720 | javaw.exe | C:\Users\admin\577cd1d5\bda431f8\a90f3bcc\db2bf213 | binary | |
MD5:54D4EAC12DCCE7F7535F28776E6C8E7B | SHA256:9C0D8C9A228D38B7AD3EE719A8905D49F5FA9A39CA847B80C56A70AC3CC41FF9 | |||
2824 | 7z_12605526030137512125269811374023.exe | C:\Users\admin\AppData\Local\Temp\qealler\python\Lib\abc.pyc | pyc | |
MD5:8E42F2E69AC98272A8FB4C6263EC38DB | SHA256:15591F8BCFC4E50E7DA8658CD5B83EB0881B32235E83CEE5197A0ECC446F16C8 | |||
2720 | javaw.exe | C:\Users\admin\AppData\Local\Temp\7z_12605185252276135402964617280637.dll | executable | |
MD5:F67F96DB0D08042F46E6680C1BE31005 | SHA256:7702FD23EFDE79E4BCF5423630876A758F15FAA38E5DF0A4434A65507A8FC792 | |||
2824 | 7z_12605526030137512125269811374023.exe | C:\Users\admin\AppData\Local\Temp\qealler\python\DLLs\_ctypes.pyd | executable | |
MD5:F349E203AAFEE9AC4F6F96A41E5C1B25 | SHA256:F46948239F0C3B64C1E93E5E1E9ABA08B84B87181A685B873C79553382278F46 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2720 | javaw.exe | GET | 200 | 188.166.150.227:8104 | http://188.166.150.227:8104/lib/7z | GB | java | 576 Kb | suspicious |
2720 | javaw.exe | GET | 200 | 188.166.150.227:8929 | http://188.166.150.227:8929/lib/qealler | GB | compressed | 1.84 Mb | suspicious |
2720 | javaw.exe | POST | 200 | 188.166.150.227:8084 | http://188.166.150.227:8084/qealler-reloaded/ping | GB | text | 108 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2720 | javaw.exe | 188.166.150.227:8104 | — | Digital Ocean, Inc. | GB | suspicious |
2720 | javaw.exe | 188.166.150.227:8084 | — | Digital Ocean, Inc. | GB | suspicious |
2720 | javaw.exe | 188.166.150.227:8929 | — | Digital Ocean, Inc. | GB | suspicious |
PID | Process | Class | Message |
---|---|---|---|
2720 | javaw.exe | A Network Trojan was detected | ET INFO JAVA - Java Archive Download |
2720 | javaw.exe | A Network Trojan was detected | MALWARE [PTsecurity] Qealler.Java.Rat HTTP header |