MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Suspicious

Unsigned installer with multiple offensive MITRE techniques and direct-IP C2 despite low engine coverage.

Trust score45Caution
MT AI confidence · 65%
ATLauncher-setup-1.3.0.0.exe
2.8 MB
4ac8068c83e84b9c9c…dcb78432d2
Antivirus engines
1 of 74 flagged
Code signing
Unsigned
Age
First seen 1y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

65%Confidence
High
Reasoning

The file is an unsigned Inno Setup installer for what appears to be ATLauncher (Minecraft mod launcher). While engine coverage is high, only a single low-trust engine raised a generic malicious flag. However, sandbox execution revealed eight offensive MITRE techniques including process injection into Explorer, LSASS credential access, persistence mechanisms and direct-IP C2 to 15 addresses without domain resolution. These behaviours are inconsistent with a clean installer even accounting for Java runtime extraction. Prevalence is high and one similar imphash was previously marked safe, yet the lack of signing and specific heuristic triggers keep the assessment in mixed-signals territory.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines.onlyLowTrustFlagging=true and tier1Malicious=0 (APEX low_trust 'Malicious' only)

  2. behaviour.offensiveTechniques includes T1055, T1485, T1486, T1543.003, T1547.001, T1548, T1562.001 (8 total)

  3. triggeredHeuristics: MalwareTips.Synth.ProcessInjection, MalwareTips.Synth.CredentialDumper, MalwareTips.Synth.DirectIpC2 all fired

  4. prevalence.classification=common_old with 4655 submissions; similarHashes[1].verdict=safe (imphash match)

  5. signing.verified=null (unsigned) and filenameAnalysis.hasInstallerHint=true

Points in its favour
  • High prevalence (common_old, 4655 submissions)
  • 69/70 engines undetected
  • No tier-1 malicious detections
  • No malicious dropped children
  • One prior safe verdict on similar imphash
Points against
  • Unsigned executable
  • 8 offensive MITRE techniques observed
  • Direct-IP C2 with no DNS usage
  • LSASS access and process injection indicators
  • Mixed community annotations including suspicious tags
What to do

Treat as suspicious pending further verification; obtain the official installer from the vendor site and compare hashes before running.

Sources disagree

1 contradiction resolved by the scoring engine

Only low-trust / heuristic engines flagged this file
1 engine from the heuristic / generic-AI set flagged it. No tier-1 engine agreed.
Detection weight reduced in scoring.
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
36

Adversary techniques mapped to the MITRE ATT&CK framework.

T1012T1027T1027.002T1033T1036T1055T1057T1059T1070T1070.006T1071T1082T1083T1095T1106T1112T1129T1134T1202T1203T1485T1486T1497T1518.001+12 more
Spawned processes
15
$(unnamed)
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
$(unnamed)
"C:\Users\<USER>\Desktop\executable.exe"
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\is-JL76O.tmp\executable.tmp" /SL5="$200EA,1538498,1214464,C:\Users\<USER>\Desktop\executable.exe"
$(unnamed)
C:\Windows\Explorer.EXE
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\is-9OVP1.tmp\7za.exe" x "C:\Users\<USER>\AppData\Local\Temp\is-9OVP1.tmp\jre.zip" -o"C:\Users\<USER>\AppData\Roaming\ATLauncher\" * -r -aoa
$(unnamed)
"C:\Users\<USER>\AppData\Roaming\ATLauncher\ATLauncher.exe"
$(unnamed)
"C:\Users\<USER>\AppData\Roaming\ATLauncher\jre\bin\javaw.exe" -version
$(unnamed)
C:\Windows\system32\services.exe
+7 more processes captured.
Network activity
20
IP addresses20
  • 172.66.174.26
  • 140.82.112.3
  • 185.199.109.133
  • 192.168.0.44
  • 20.99.133.109
  • 23.55.140.42
  • 192.168.0.56
  • 20.69.140.28
  • 217.20.54.35
  • 23.196.145.221
+10 more
Filesystem & mutexes
34
Files written15
  • C:\Users\<USER>\AppData\Local\Temp\is-JL76O.tmp\executable.tmp
  • C:\Users\<USER>\AppData\Local\Temp\is-9OVP1.tmp\_isetup\_setup64.tmp
  • C:\Users\<USER>\AppData\Local\Temp\is-9OVP1.tmp\is-84J8L.tmp
  • C:\Users\<USER>\AppData\Local\Temp\is-9OVP1.tmp\ATLauncher.exe
  • C:\Users\<USER>\AppData\Local\Temp\is-9OVP1.tmp\is-LOQCU.tmp
+10 more
Files deleted15
  • C:\Users\<USER>\AppData\Roaming\ATLauncher\is-6V2HK.tmp
  • C:\Users\<USER>\AppData\Roaming\ATLauncher\is-RDD54.tmp
  • C:\Users\<USER>\AppData\Local\Temp\is-9OVP1.tmp\jre.zip
  • C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ATLauncher\ATLauncher.lnk
  • C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ATLauncher\ATLauncher.pif
+10 more
Mutexes created4
  • cversions.3.m
  • \Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
  • \Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
  • \Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • ac3706ebbb78cfba74e5…0aba8fNever scanned
    never seen before
  • fbc6a2793193035702a3…3104b4Never scanned
    never seen before
  • dc130da62ff3a8b7ffb6…8f414dNever scanned
    never seen before
  • 0221646b013037b9f474…ddafb2Never scanned
    never seen before
  • 5a7ff949f6d93d86491e…420023Never scanned
    never seen before
  • 388a796580234efc95f3…136f95Never scanned
    never seen before
  • 4439a2331396cfbcbfbb…d300a8Never scanned
    never seen before
  • ea308c76a2f927b160a1…4e716dNever scanned
    never seen before
  • 90ac2104fa150b68518e…a8a8d4Never scanned
    never seen before
  • 6c491d6f8c28c6f451f0…b1477bNever scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

3 synthesis
MITRE ATT&CK profile
Defense evasion× 1Cred access× 1C2× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • ProcessInjection
    T1055
    high

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    C:\Windows\Explorer.EXE
  • CredentialDumper
    T1003T1003.001
    medium

    Sandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.

    Evidence
    C:\Windows\system32\lsass.exe
  • DirectIpC2
    T1071
    medium

    Sample contacted 15 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    172.66.174.26 · 140.82.112.3 · 185.199.109.133
Antivirus engine breakdown

1 detection across 74 engines

1 malicious0 suspicious73 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-238 engines
0flag
Mainstream engines with mixed FP rates
Low-trust19 engines
1flag
Heuristic / generic-AI engines (high FP rate)
APEX
malicious
Malicious
Hash 4ac8068c83e8… cross-referenced against 74 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 8.00Unpacked
Section entropy10 sections
.text
6.38
.itext
6.17
.data
4.97
.bss
0.00
.idata
5.02
.didata
2.73
.edata
1.31
.tls
0.00
.rdata
1.39
.reloc
6.71
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old
Unique uploaders
3,176
Hundreds of people have uploaded this — common.
Total submissions
4,655
Includes repeat uploads by the same source.
First seen by VT
1y ago
May 10, 2025
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
here
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
5/10/2025, 10:31:59 PM
First seen (MalwareBazaar)
—
Last analysis (VT)
7/4/2026, 12:52:14 PM
Scanned here
7/5/2026, 5:05:12 AM
File name
ATLauncher-setup-1.3.0.0.exe
Size
2.79 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
4ac8068c83e84b9c9c09dcad37120ed4041e72480c4e9a36543445dcb78432d2
MD5
9d56b8206cbc9f298dfe5991161ef21d
SHA-1
c4f531d4499676685c162c014e6024a441bed82c
PE imphash
40ab50289f7ef5fae60801f88d4541fc
First seen (VT)
5/10/2025, 10:31:59 PM
Last analysis (VT)
7/4/2026, 12:52:14 PM
First scan (MalwareTips)
7/5/2026, 5:05:12 AM
Last scan (MalwareTips)
7/5/2026, 5:05:12 AM
Community reputation
-3flagged
Behavior tags
detect-debug-environmentlong-sleepspeexeoverlay
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scanned by
pennies
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.