ChainlessChain IDE Bridge 0.4.138
Encoded PowerShell backdoor, C2, ransomware strings
JetBrains plugin stages a remote PowerShell payloadJava downloads an executable to a temporary path and launches it through cmd
SHA-2567d024f083ace170ae2d0112891f37795d883b9f3aef9f491580bf6c9606a57cb
Evidence
0x0cafebabe00000041039d0a0002000307.......A........
0x1000040c000500060100106a6176612f6c..........java/l
0x20616e672f4f626a6563740100063c696eang/Object...<in
0x3069743e01000328295609000800090700it>...()V.......
0x400a0c000b000c010020636f6d2f636861........ com/cha
0x50696e6c657373636861696e2f6964652finlesschain/ide/
⋯7 more rows
⋯11 more rows
0x1104400c0141005b01000672756e436c6908@..A.[...runCli.
0x111401430100076f732e6e616d650a014501.C...os.name..E.
0x1124460701470c014800ee0100106a617661F..G..H.....java
⋯7 more rows
⋯3 more rows
0x12116c656374696f6e3b295a07015f010018lection;)Z.._...
0x12216a6176612f6c616e672f50726f636573java/lang/Proces
0x1231734275696c6465720a015e01610c0005sBuilder..^.a...
0x12410162010013284c6a6176612f7574696c.b...(Ljava/util
0x12512f4c6973743b29560a01640165070166/List;)V..d.e..f
0x12610c01670168010022636f6d2f63686169..g.h.."com/chai
0x12716e6c657373636861696e2f6964652f43nlesschain/ide/C
⋯3 more rows
0x12b1696c6465723b29560a015e016a0c016bilder;)V..^.j..k
0x12c1016c0100137265646972656374457272.l...redirectErr
0x12d16f7253747265616d01001d285a294c6aorStream...(Z)Lj
0x12e16176612f6c616e672f50726f63657373ava/lang/Process
0x12f14275696c6465723b0a015e016e0c016fBuilder;..^.n..o
0x13010170010005737461727401001528294c.p...start...()L
0x13116a6176612f6c616e672f50726f636573java/lang/Proces
0x1321733b0a017201730701740c0175017601s;..r.s..t..u.v.
0x133100116a6176612f6c616e672f50726f63..java/lang/Proc
0x134165737301000e676574496e7075745374ess...getInputSt
0x13517265616d01001728294c6a6176612f69ream...()Ljava/i
0x13616f2f496e70757453747265616d3b1200o/InputStream;..
0x13710301780c00490179010034284c6a6176..x..I.y..4(Ljav
⋯7 more rows
⋯3 more rows
0x1c48cd019f0a019b02370c02380096010008.......7..8.....
0x1c58746f537472696e67120006023a0c0039toString....:..9
0x1c68023b0100152849294c6a6176612f6c61.;...(I)Ljava/la
0x1c786e672f537472696e673b07023d01001dng/String;..=...
0x1c886a6176612f696f2f4279746541727261java/io/ByteArra
0x1c98794f757470757453747265616d0a023cyOutputStream..<
0x1ca8000303000100000a021002410c024202...........A..B.
0x1cb84301000472656164010005285b422949C...read...([B)I
0x1cc8080245010012646f776e6c6f61642d74..E...download-t
0x1cd86f6f2d6c617267650a023c02470c0248oo-large..<.G..H
0x1ce802490100057772697465010007285b42.I...write...([B
0x1cf8494929560a023c024b0c024c024d0100II)V..<.K..L.M..
0x1d080b746f42797465417272617901000428.toByteArray...(
0x1d18295b420a023c021b080250010012746f)[B..<....P...to
0x1d286f2d6d616e792d726564697265637473o-many-redirects
⋯4 more rows
0x1d780802580100086261642d6a736f6e0802..X...bad-json..
0x1d885a010007636d642e65786508025c0100Z...cmd.exe..\..
0x1d98022f6308025e0100046e6f6465080260./c..^...node..`
0x1da80100092d2d76657273696f6e07026201...--version..b.
0x1db800186a6176612f6c616e672f50726f63..java/lang/Proc
0x1dc86573734275696c6465720a026102640cessBuilder..a.d.
0x1dd800050265010013284c6a6176612f7574...e...(Ljava/ut
0x1de8696c2f4c6973743b29560a0267026807il/List;)V..g.h.
0x1df802690c026a026b010022636f6d2f6368.i..j.k.."com/ch
0x1e0861696e6c657373636861696e2f696465ainlesschain/ide
⋯3 more rows
0x1e484275696c6465723b29560a0261026d0cBuilder;)V..a.m.
0x1e58026e026f010013726564697265637445.n.o...redirectE
0x1e6872726f7253747265616d01001d285a29rrorStream...(Z)
0x1e784c6a6176612f6c616e672f50726f6365Ljava/lang/Proce
0x1e8873734275696c6465723b0a026102710cssBuilder;..a.q.
0x1e9802720273010005737461727401001528.r.s...start...(
0x1ea8294c6a6176612f6c616e672f50726f63)Ljava/lang/Proc
0x1eb86573733b0a027502760702770c027802ess;..u.v..w..x.
0x1ec8790100116a6176612f6c616e672f5072y...java/lang/Pr
0x1ed86f6365737301000e676574496e707574ocess...getInput
0x1ee853747265616d01001728294c6a617661Stream...()Ljava
0x1ef82f696f2f496e70757453747265616d3b/io/InputStream;
0x1f080a0210027b0c027c027d01000a726561....{..|.}...rea
⋯3 more rows
0x18a80c019e019f010005746f55524c010010........toURL...
0x18b828294c6a6176612f6e65742f55524c3b()Ljava/net/URL;
0x18c80a01a101a20701a30c01a401a501000c................
0x18d86a6176612f6e65742f55524c01000e6fjava/net/URL...o
0x18e870656e436f6e6e656374696f6e01001apenConnection...
0x18f828294c6a6176612f6e65742f55524c43()Ljava/net/URLC
0x19086f6e6e656374696f6e3b0701a701001aonnection;......
0x19186a6176612f6e65742f4874747055524cjava/net/HttpURL
0x1928436f6e6e656374696f6e0a01a601a90cConnection......
0x193801aa01ab010011736574436f6e6e6563.......setConnec
0x19487454696d656f7574010004284929560atTimeout...(I)V.
0x195801a601ad0c01ae01ab01000e73657452............setR
0x196865616454696d656f75740801b0010006eadTimeout......
⋯6 more rows
0x19d86e673b29560a01a601b80c01b901ba01ng;)V...........
0x19e8000f676574526573706f6e7365436f64..getResponseCod
0x19f8650100032829490a01a601bc0c01bd00e...()I.........
0x1a080601000a646973636f6e6e6563740701....disconnect..
0x1a18bf0100176a6176612f6c616e672f5374....java/lang/St
⋯4 more rows
0x1a68747265616d5265616465720a01a601c6treamReader.....
0x1a780c01c701c801000e676574496e707574........getInput
0x1a8853747265616d01001728294c6a617661Stream...()Ljava
0x1a982f696f2f496e70757453747265616d3b/io/InputStream;
0x1aa80901ca01cb0701cc0c01cd01ce010021...............!
0x1ab86a6176612f6e696f2f63686172736574java/nio/charset
⋯7 more rows
Showing the top 5 files — 6 more files (56 regions) not shown.
No evidence locations were recorded for this file. Raw result