malware2_cleaned.jar

Classification: Malicious

malware2_cleaned.jar is a trojan (Java archive, 570.7 KB). Flagged by 53% of antivirus engines (32 detections). Linked to Jrat malware.

Detection summary

  • 32 antivirus detections (53% detection ratio)
  • 0 IDS alerts
  • 320 processes observed
  • 1 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: JRAT (S0283)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Adwind Triage 2026-05-04 07:38:24 2026-10-11 05:16:54 malicious-activity S0283 jRAT
Generic Malware Hybrid-Analysis 2024-09-16 06:30:05 2025-10-01 11:15:09
Java.Trojan.GenericGB Hybrid-Analysis 2020-09-24 09:00:13 2020-09-24 09:00:13

Tags

trojan evasive adwind defense_evasion persistence discovery execution

Sample information

Filenames
5b44e9b540425a8d1a7889bb1749300e0ed46b7ecdd7aff46ddf0d5c4768a126, malware2_cleaned.jar, 5b44e9b540425a8d1a7889bb1749300e0ed46b7ecdd7aff46ddf0d5c4768a126_fr, loaded_5b44e9b540425a8d1a7889bb1749300e0ed46b7ecdd7aff46ddf0d5c4768a126
File type
Java archive data (JAR)
Size
584356 bytes
MD5
738115b0931b9515c0fd8211a1ee2308
SHA-1
9df1b42b462f1383f74e2ffe31d45be9784e12bb
SHA-256
5b44e9b540425a8d1a7889bb1749300e0ed46b7ecdd7aff46ddf0d5c4768a126
First indexed
2020-09-24 09:00:13
Last updated
2026-10-11 05:56:50

Antivirus detections

EngineDetection
AVGJava:Malware-gen [Trj]
AlibabaTrojan:JAVA/Kryptik.eb39a31a
ArcabitJava.Trojan.GenericGB.D1230 [many]
AvastJava:Malware-gen [Trj]
AviraEXP/JAVA.Kryptik.A.Gen
BaiduJava.Trojan.Agent.a
BitDefenderJava.Trojan.GenericGB.4656
CTXjar.trojan.java
ClamAVJava.Malware.Agent-6331893-0
CynetMalicious (score: 99)
ESET-NOD32multiple detections
EmsisoftJava.Trojan.GenericGB.4656 (B)
F-SecureExploit.EXP/JAVA.Kryptik.A.Gen
FortinetJava/Kryptik.FL!tr
GDataJava.Backdoor.Adwind.O
GoogleDetected
IkarusTrojan.Java.Crypt
KasperskyHEUR:Trojan.Java.Agent.gen
LionicTrojan.ZIP.Java.4!c
MicroWorld-eScanJava.Trojan.GenericGB.4656
NANO-AntivirusTrojan.Zip.Agent.ermozy
RisingTrojan.Kryptik/JAVA!1.ACD0 (CLASSIC)
SkyhighJV/Backdoor-Adwind.k
SymantecTrojan.Gen.NPE
TencentJava.Trojan.Agent.Gajl
TrellixENSAdwind-FMAE!C02F4B0053B0
TrendMicroJAVA_ADWIND.JEJPCP
TrendMicro-HouseCallJAVA_ADWIND.JEJPCP
VIPREJava.Trojan.GenericGB.4656
VaristJava/Adwind.F.gen!Eldorado
VirITTrojan.Java.Jrat.CG
alibabacloudExploit:Java/Agent.gyf

Network contacts

192.223.25.85

Process list

NameCommand line
javaw.exe-jar "C:\5b44e9b540425a8d1a7889bb1749300e0ed46b7ecdd7aff46ddf0d5c4768a126.jar"
icacls.exe%ALLUSERSPROFILE%\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
java.exe-jar %TEMP%\_0.073917323313588696703395329032655281.class
cmd.exe/C cscript.exe %TEMP%\Retrive5132039592210594075.vbs
cscript.exe%TEMP%\Retrive5132039592210594075.vbs
cmd.exe/C cscript.exe %TEMP%\Retrive3110217806649694618.vbs
cscript.exe%TEMP%\Retrive3110217806649694618.vbs
cmd.exe
cmd.exe/C cscript.exe %TEMP%\Retrive3359741704291895978.vbs
cscript.exe%TEMP%\Retrive3359741704291895978.vbs
cmd.exe/C cscript.exe %TEMP%\Retrive8862859921075285400.vbs
cscript.exe%TEMP%\Retrive8862859921075285400.vbs
xcopy.exexcopy "%PROGRAMFILES%\Java\jre-1.8" "%APPDATA%\Oracle\" /e
cmd.exe
reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ytYDPkeIGjb /t REG_EXPAND_SZ /d "\"%APPDATA%\Oracle\bin\javaw.exe\" -jar \"%USERPROFILE%\UBcRZttqExe\ZMpCTnzYFHz.vEPRwc\"" /f
attrib.exeattrib +h "%USERPROFILE%\UBcRZttqExe"
attrib.exeattrib +h "%USERPROFILE%\UBcRZttqExe\*.*"
javaw.exe-jar %USERPROFILE%\UBcRZttqExe\ZMpCTnzYFHz.vEPRwc
java.exe-jar %TEMP%\_0.29528689135725637941752153402852707.class
cmd.exe/C cscript.exe %TEMP%\Retrive7472742558205850592.vbs
cscript.exe%TEMP%\Retrive7472742558205850592.vbs
cmd.exe/C cscript.exe %TEMP%\Retrive3439991405416709927.vbs
cscript.exe%TEMP%\Retrive3439991405416709927.vbs
reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ytYDPkeIGjb /t REG_EXPAND_SZ /d "\"%APPDATA%\Oracle\bin\javaw.exe\" -jar \"%USERPROFILE%\UBcRZttqExe\ZMpCTnzYFHz.vEPRwc\"" /f
attrib.exeattrib +h "%USERPROFILE%\UBcRZttqExe\*.*"
attrib.exeattrib +h "%USERPROFILE%\UBcRZttqExe"
javaw.exe-jar %USERPROFILE%\UBcRZttqExe\ZMpCTnzYFHz.vEPRwc
java.exe-jar %TEMP%\_0.951725375655291796435070362474911.class
cmd.exe/C cscript.exe %TEMP%\Retrive2287426930013198407.vbs
cscript.exe%TEMP%\Retrive2287426930013198407.vbs