Find similar analyses in TI Lookup

Analysis date (UTC): 30 March 2018, 10:57Analysis environment: Windows 7 Pro, build 7601, x86

zyczu-mc.jar

MD5:483CF59AD76CCBCD95FE6C80796DD172

SHA1:8F6AB62822C1042C09314D09097629B4CB63350A

SHA256:DC1F5E79ECADFCEE517E1CD6FD69FFF9E90593952A2920C6AE5CAA6CA9A18E1D

Analysis result

Threat level:Malicious activity

Full analysis:Analysis zyczu-mc.jar (MD5: 483CF59AD76CCBCD95FE6C80796DD172) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application loaded dropped or rewritten executable

javaw.exe (PID: 932)
javaw.exe (PID: 2168)

SUSPICIOUS

Creates files in the user directory

javaw.exe (PID: 2168)
javaw.exe (PID: 932)

Application launched itself

javaw.exe (PID: 2168)

Executes JAVA applets

javaw.exe (PID: 2168)

INFO

Dropped object may contain URL's

javaw.exe (PID: 932)

Threats

PID	Process	Class	Message
—	—	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 256