ANY.RUN Interactive Sandbox
- Full browser-level visibility into phishing
- Huge database of samples and IOCs
- Interactivity in a safe environment
- Actionable Tier 1 reports
Get full visibility into malware and phishing behavior in a safe environment.
| File name: | astraware v4.jar |
| Full analysis: | https://app.any.run/tasks/71e56076-b51c-4c36-81cb-06f6f943c376 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | May 21, 2026, 17:12:23 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/java-archive |
| File info: | Java archive data (JAR) |
| MD5: | 35E0B84D386330A852861F545973C8B5 |
| SHA1: | BB905FD7855D07F9892A2BEAA624E61CD41618A5 |
| SHA256: | CE23C7C61597BFA79EE853EFA55185D9FF4924B68071C0659C1FAFCFF65BBDEA |
| SSDEEP: | 98304:tNQEeUOZQMoVrKkTGFoneCQnUhLbN3E31D2COUh/ijgDms+hZNM3Wy2/aWAEz3SG:LwxOCNYIZD40QVh |
MALICIOUS
WEEDHACK has been detected (SURICATA)
- javaw.exe (PID: 3424)
Stealers network behavior
- javaw.exe (PID: 3424)
SUSPICIOUS
Application launched itself
- javaw.exe (PID: 416)
INFO
Create files in a temporary directory
- javaw.exe (PID: 416)
- javaw.exe (PID: 3424)
Checks supported languages
- javaw.exe (PID: 416)
- javaw.exe (PID: 3424)
Reads Environment values
- javaw.exe (PID: 416)
- javaw.exe (PID: 3424)
Reads CPU info
- javaw.exe (PID: 416)
- javaw.exe (PID: 3424)
Reads the machine GUID from the registry
- javaw.exe (PID: 3424)
Reads the computer name
- javaw.exe (PID: 3424)
Creates files or folders in the user directory
- javaw.exe (PID: 3424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .jar | | | Java Archive (78.3) |
|---|---|---|
| .zip | | | ZIP compressed archive (21.6) |
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0808 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2026:05:09 17:30:38 |
| ZipCRC: | 0x2c60c382 |
| ZipCompressedSize: | 12302 |
| ZipUncompressedSize: | 21302 |
| ZipFileName: | a/zz.class |
Total processes
123
Monitored processes
2
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 416 | "C:\Program Files\Java\jdk-25.0.2\bin\javaw.exe" -jar "C:\Users\admin\Desktop\astraware v4.jar" | C:\Program Files\Java\jdk-25.0.2\bin\javaw.exe | — | explorer.exe | |||||||||||
User: admin Company: N/A Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 25.0.2.0 Modules
| |||||||||||||||
| 3424 | "C:\Program Files\Java\jdk-25.0.2\bin\javaw.exe" -jar "C:\Users\admin\Desktop\astraware v4.jar" --jw | C:\Program Files\Java\jdk-25.0.2\bin\javaw.exe | javaw.exe | ||||||||||||
User: admin Company: N/A Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Version: 25.0.2.0 Modules
| |||||||||||||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
1
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3424 | javaw.exe | C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\83aa4cc77f591dfc2374580bbd95f6ba_bb926e54-e3ca-40fd-ae90-2764341e7792 | binary | |
MD5:C8366AE350E7019AEFC9D1E6E6A498C6 | SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
9
DNS requests
7
Threats
5
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | US | binary | 814 b | whitelisted |
— | — | GET | 200 | 23.216.77.21:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | NL | binary | 825 b | whitelisted |
— | — | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | US | binary | 814 b | whitelisted |
— | — | POST | 500 | 48.192.1.65:443 | https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail | US | xml | 512 b | whitelisted |
3424 | javaw.exe | GET | 200 | 1.1.1.1:443 | https://cloudflare-dns.com/dns-query?name=eth.api.onfinality.io&type=A | AU | text | 288 b | unknown |
— | — | GET | 200 | 1.1.1.1:443 | https://cloudflare-dns.com/dns-query?name=eth.llamarpc.com&type=A | AU | text | 266 b | unknown |
3424 | javaw.exe | POST | 200 | 142.215.53.55:443 | https://eth.api.onfinality.io/public | CA | text | 934 b | malicious |
3424 | javaw.exe | GET | — | 185.178.208.147:443 | https://fucktermedfir.st/files/jar/module | RU | — | — | — |
3424 | javaw.exe | GET | 200 | 1.1.1.1:443 | https://cloudflare-dns.com/dns-query?name=fucktermedfir.st&type=A | AU | text | 198 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 192.168.100.255:137 | — | Not routed | — | whitelisted |
— | — | 48.209.138.168:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 48.192.1.64:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 192.168.100.255:138 | — | Not routed | — | whitelisted |
3424 | javaw.exe | 104.16.249.249:443 | cloudflare-dns.com | CLOUDFLARENET | US | whitelisted |
3424 | javaw.exe | 104.21.67.22:443 | — | CLOUDFLARENET | US | whitelisted |
3424 | javaw.exe | 142.215.53.55:443 | — | EQUINIX | NL | whitelisted |
3424 | javaw.exe | 185.178.208.147:443 | — | DDOS-GUARD | RU | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
activation-v2.sls.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
cloudflare-dns.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2232 | svchost.exe | Misc activity | INFO [ANY.RUN] Cloudflare DNS-over-HTTPS service requested (cloudflare-dns .com) |
3424 | javaw.exe | Misc activity | ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI) |
3424 | javaw.exe | A Network Trojan was detected | STEALER WeedHack TLS activity observed |
— | — | A Network Trojan was detected | ET MALWARE EtherHiding Exfil M2 |
— | — | A Network Trojan was detected | ET MALWARE EtherHiding Exfil M2 |