CLEAN — 98aad308c5253ec6205279bf56efeb83919dcc9584b125734cefb0cc48ad1c43.jar

CLEAN — 98aad308c5253ec6205279bf56efeb83919dcc9584b125734cefb0cc48ad1c43.jar is a jar sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (14/100). 3 of 53 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 98aad308c5253ec6205279bf56efeb83919dcc9584b125734cefb0cc48ad1c43
SHA-1: abd0a1ebf5cd15fd94cf59a2cc92d9a345a816f4
MD5: 6f9d0d5f118c665014ea6df12767c91c
ssdeep: 12288:/zEOw5Er/aofzzbe3NhCu5Jm+yfHLrT6Ndpm6unL://QZKPq73YLGSZnL
TLSH: T1514CF1EAD2055242D38856B0213CF82DE5449D90E41C831A7E82AEED477175F8B2DEEB
Submitted as: 98aad308c5253ec6205279bf56efeb83919dcc9584b125734cefb0cc48ad1c43.jar
File type: jar · Size: 564115 bytes
Verdict: clean (14/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): Trojan.GenericKD.81008403
Kaspersky (KVRT): HEUR:Trojan.Java.Generic

MITRE ATT&CK

Why this verdict

The clean score of 14/100 is the fusion of 1 weighted signal:

Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

82637 behavior events · 2 ATT&CK techniques · 237 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_internal\build_env\__init__.py - 008e71d8a7efd5ec46d486ec347b885756a0a8d82cb538ff2d6a5bc162eaf289
C:\Users\analyst\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pywin32.pth - e7cd73df98b91c407dfd96d1f4dd18b7f9a60f29902b92cf5ece79b6eb637b81
c:\users\analyst\appdata\local\microsoft\windows\ntprofileindex\lib\site-packages\urllib3\util\__pycache__\connection.cpython-312.pyc - 9607db966a67389128abd637b15213cdfa4f36fe7db7c4087111e926b3e95130
C:\Users\analyst\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_internal\cache.py - 7aa31055fa43f31ec67023b4574cfbde69e33c8b926a9305a10fd6444ee22d8f
C:\Users\analyst\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\PIL\DcxImagePlugin.py - 2f6d5cde0557e883e6938cee7ff96db779807917dcb8209c5e1902569b9e7765
C:\Users\analyst\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_internal\commands\freeze.py - 2e0f043a89319d166bc1d2d62602e9056c4d52defe1eb9169440b4e5efaf070c
C:\Users\analyst\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\PIL\BlpImagePlugin.py - 1291e85528585f2a6ac671288924a19e00fb08f842798f1e7f0487d46e659d79
C:\Users\analyst\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\adodbapi\setup.py - 2b8d5503fd492a5494649525fd02ab1e152f6c5d09479b6555e820efffe2d625
C:\Users\analyst\AppData\Local\Microsoft\Windows\IManagementEngine\Lib\site-packages\pip\_internal\exceptions.py - 65dbb5ee955b0f5788ff28e0e7665dd32800583cbc2ed5d2d40b5fbe7d693edb
C:\Users\analyst\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\PIL\CurImagePlugin.py - 3bf6c5b56f3662100cf3f17cb69af73b952bcca3cfca257d4b6ce357d430a9a2
C:\Users\analyst\AppData\Local\Microsoft\Windows\NtProfileIndex\_asyncio.pyd - 184fc13677c7856e7a8b31dfe79ce68dcea10cdf83a205de2b0d5497fb0ffdf3
C:\Users\analyst\AppData\Local\Microsoft\Windows\NtProfileIndex\python312.zip - 50923b458dad653990105637b17227af36cde152cfc1f88c16c99672a82d2e9c
c:\users\analyst\appdata\local\microsoft\windows\ntprofileindex\lib\site-packages\urllib3\util\__pycache__\util.cpython-312.pyc - 141ecd254716d9fc3f532c3a119df43e4bb9664c62b5eaaebf8b9b33c6c3f2e1
c:\users\analyst\appdata\local\microsoft\windows\ntprofileindex\lib\site-packages\idna\__pycache__\core.cpython-312.pyc - 17058f93687d505ab9e1fd570e34b291e978ff9fd544ffecad3c19dd074994c9
c:\users\analyst\appdata\local\microsoft\windows\ntprofileindex\lib\site-packages\charset_normalizer\__pycache__\api.cpython-312.pyc - 6b18a09fe061d4b3c9f14d9dffd34982747b2b964720fa621df1b3087aacd468

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787586987&P2=404&P3=2&P4=WiaPxKnQCx3wZSbv8EYspJYnNxkyK8C8%2fZx5Hrpya1hpUwCwCoNiWkUnMvMw5gAfMjv4ukH%2f1CFX751qfDYrWQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787587076&P2=404&P3=2&P4=BPxe46Ya4waOsbBuqujvFRfbq1Eq4vXN56g0s9DBJPkqDoz%2fXKhAqCQntqdvJrAjAdMrXeN96rMLrb8vpYC9yw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

j.us
polygon-rpc.com
rpc-mainnet.matic.quiknode.pro
polygon-public.nodies.app
1rpc.io
polygon-mainnet.rpcfast.com
polygon-bor-rpc.publicnode.com
go.getblock.io
api.zan.top
polygon.rpc.subquery.network
endpoints.omniatech.io
bootstrap.pypa.io
sltnnt.ru
files.pythonhosted.org

Embedded IP addresses

52.123.252.222
20.42.73.25
57.155.101.212
4.230.171.124
52.230.59.222
135.233.95.144
135.232.92.97
20.42.65.89
4.150.223.100
20.236.44.162
52.123.128.14
52.123.129.14
135.233.45.221
104.18.11.59
203.26.79.13
185.178.208.191
52.148.114.188
104.16.248.249
206.223.224.224
132.145.155.63
104.26.4.88
104.21.77.34
104.21.80.104
172.66.150.162
31.172.68.70

File paths

F:\i4

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report