4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019_unsafe
Classification: Malicious
4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019_unsafe is a malicious file sample (Java archive, 570.9 KB). Linked to Jrat malware.
Detection summary
- 0 antivirus detections (43% detection ratio)
- 1 IDS alerts
- 268 processes observed
- 1 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: JRAT (S0283)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Adwind | Triage | 2026-09-29 06:07:58 | 2026-10-06 07:34:12 | malicious-activity | S0283 jRAT |
| Generic Malware | Hybrid-Analysis | 2023-09-17 12:30:03 | 2024-10-06 08:45:19 | ||
| HEUR:Trojan.Java.Agent | Hybrid-Analysis | 2020-09-24 12:17:18 | 2020-09-24 12:17:18 |
Tags
evasive adwind defense_evasion discovery execution persistence trojanSample information
- Filenames
- 4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019_unsafe, 4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019, loaded_4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019
- File type
- Java archive data (JAR)
- Size
- 584579 bytes
- MD5
31f90d8a8a473074bfeef7972d5a39b2- SHA-1
083a3c0e8c33f1ea8d0f59f76e8e82a6871aebdd- SHA-256
4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019- First indexed
- 2020-09-24 12:17:19
- Last updated
- 2026-10-07 14:52:25
Network contacts
Process list
| Name | Command line |
|---|---|
| javaw.exe | -jar "C:\4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019.jar" |
| java.exe | -jar %TEMP%\_0.49623586044978225655661147531118056.class |
| cmd.exe | /C cscript.exe %TEMP%\Retrive2849106263957121682.vbs |
| cscript.exe | %TEMP%\Retrive2849106263957121682.vbs |
| cmd.exe | /C cscript.exe %TEMP%\Retrive4355474351646047276.vbs |
| cscript.exe | %TEMP%\Retrive4355474351646047276.vbs |
| xcopy.exe | xcopy "%PROGRAMFILES%\Java\jre1.8.0_151" "%APPDATA%\Oracle\" /e |
| cmd.exe | /C cscript.exe %TEMP%\Retrive8175416959029241102.vbs |
| cscript.exe | %TEMP%\Retrive8175416959029241102.vbs |
| cmd.exe | /C cscript.exe %TEMP%\Retrive6897200656402351113.vbs |
| cscript.exe | %TEMP%\Retrive6897200656402351113.vbs |
| xcopy.exe | xcopy "%PROGRAMFILES%\Java\jre1.8.0_151" "%APPDATA%\Oracle\" /e |
| cmd.exe | |
| reg.exe | reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NYRZDOmEJZd /t REG_EXPAND_SZ /d "\"%APPDATA%\Oracle\bin\javaw.exe\" -jar \"%USERPROFILE%\xmpCzqQrOmL\LPZiwaCeIRf.jcCGXp\"" /f |
| attrib.exe | attrib +h "%USERPROFILE%\xmpCzqQrOmL\*.*" |
| attrib.exe | attrib +h "%USERPROFILE%\xmpCzqQrOmL" |
| javaw.exe | -jar %USERPROFILE%\xmpCzqQrOmL\LPZiwaCeIRf.jcCGXp |
| icacls.exe | %ALLUSERSPROFILE%\Oracle\Java\.oracle_jre_usage\5b19d698432b458f.timestamp /grant "everyone":(OI)(CI)M |
| java.exe | -jar %TEMP%\_0.879480807578034819317736222135521.class |
| javaw.exe | -jar "C:\loaded_4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019.jar" |
| java.exe | -jar %TEMP%\_0.75358324222776346700934908319455320.class |
| cmd.exe | /C cscript.exe %TEMP%\Retrive4273608631000688677.vbs |
| cscript.exe | %TEMP%\Retrive4273608631000688677.vbs |
| cmd.exe | /C cscript.exe %TEMP%\Retrive7133181947538709300.vbs |
| cscript.exe | %TEMP%\Retrive7133181947538709300.vbs |
| cmd.exe | |
| cmd.exe | /C cscript.exe %TEMP%\Retrive1285288396886293769.vbs |
| cscript.exe | %TEMP%\Retrive1285288396886293769.vbs |
| cmd.exe | /C cscript.exe %TEMP%\Retrive1156991940141932570.vbs |
| cscript.exe | %TEMP%\Retrive1156991940141932570.vbs |