🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 092de0bc5c72127a36d81e534114ee31af8829d8d8d4055c19ec9f4b36de69fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adwind


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 092de0bc5c72127a36d81e534114ee31af8829d8d8d4055c19ec9f4b36de69fd
SHA3-384 hash: 5cfa111597808522f6aa604b06b137df33387ea5be97db4767190e640ea82d392daa2433872f79a26b9a29ad729a45b4
SHA1 hash: 216fd84874e484daf7d00e0fbea55686bc9e4d50
MD5 hash: 6d7dbef56470a8b27a3ea4ebed1aa4af
humanhash: emma-cold-march-high
File name:unkownklosa.jar
Download: download sample
Signature Adwind
Create hunting rule
File size:735'085 bytes
First seen:2023-03-28 14:13:03 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 12288:21VlhiXhpJf2Fo8ikaz/6aCiVitOI/Rm2tbggV09P4aszofR4DH03ZkNEnd6iMgu:eiXxkoVH/nIZVr09zs9DHiZkV7
TLSH T127F4238BF8101BAEFF58E03E084D6FA047396E356863FD850A77453B91899C1E9D846F
TrID 72.9% (.JAR) Java Archive (13500/1/2)
21.6% (.ZIP) ZIP compressed archive (4000/1)
5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter malwarelabnet
Tags:Adwind jar

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
unkownklosa.jar
Verdict:
Malicious activity
Analysis date:
2023-03-28 14:13:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/92da087e-ad0a-4b69-9e3f-b9f7c2dbae5e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/378193/
Detection(s):
Java.Trojan.Adwind-6
Create hunting rule

SecuriteInfo.com.Java.Jrat-1.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGBA.31580.28182.6222.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adwind anti-debug banload exploit obfuscated
Link:
https://www.filescan.io/uploads/6422f62c9c109cf74b30568f/reports/87b245c1-78c6-420f-9f63-297595c8279f/overview
Verdict:
Malicious
Labled as:
Java.Trojan.GenericA.31580;Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/092de0bc5c72127a36d81e534114ee31af8829d8d8d4055c19ec9f4b36de69fd
Result
Threat name:
ADWIND
Create hunting rule
Detection:
malicious
Classification:
rans.troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1203593
Signature
Antivirus detection for dropped file
Collects Antivirus and Firewall information (ADWIND Rat suspicion)
Creates autostart registry keys to launch java
Detected ADWIND Rat
DLL side loading technique detected
Exploit detected, runtime environment starts unknown processes
Found Adwind RAT configuration as decrypted string
Found potential ransomware demand text
Java Jar changes file attribute to hide it from user
Java Jar creates autostart registry key (Windows persistence behavior)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses cmd line tools excessively to alter registry or file data
Uses dynamic DNS services
Yara detected AdWind RAT
Yara detected AdWind RATs dll
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 836505 Sample: unkownklosa.jar Startdate: 28/03/2023 Architecture: WINDOWS Score: 100 96 Multi AV Scanner detection for domain / URL 2->96 98 Antivirus detection for dropped file 2->98 100 Multi AV Scanner detection for dropped file 2->100 102 12 other signatures 2->102 8 cmd.exe 2 2->8         started        10 javaw.exe 15 2->10         started        14 javaw.exe 2->14         started        process3 dnsIp4 16 java.exe 28 8->16         started        20 conhost.exe 8->20         started        88 meunknown.duckdns.org 103.187.4.71, 1990, 49696, 49697 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe unknown 10->88 90 192.168.2.1 unknown unknown 10->90 78 C:\Users\...\Windows6763968753938677540.dll, PE32 10->78 dropped 80 C:\Users\...\Retrive7687997220890077607.vbs, ASCII 10->80 dropped 82 C:\Users\...\Retrive2010852746005491895.vbs, ASCII 10->82 dropped 22 WMIC.exe 10->22         started        24 cmd.exe 10->24         started        26 cmd.exe 10->26         started        84 C:\Users\...\Retrive5273048948192134047.vbs, ASCII 14->84 dropped 86 C:\Users\...\Retrive1353669060791343216.vbs, ASCII 14->86 dropped 28 cmd.exe 14->28         started        30 cmd.exe 14->30         started        file5 process6 file7 64 C:\Users\user\...\UVOBYoXQuAh.MFrnhu, Zip 16->64 dropped 66 C:\Users\...\Retrive8402225442817837693.vbs, ASCII 16->66 dropped 68 C:\Users\...\Retrive3367391904088256007.vbs, ASCII 16->68 dropped 92 Uses cmd line tools excessively to alter registry or file data 16->92 32 xcopy.exe 260 16->32         started        35 reg.exe 1 1 16->35         started        38 javaw.exe 2 16->38         started        42 6 other processes 16->42 94 DLL side loading technique detected 22->94 40 conhost.exe 22->40         started        44 2 other processes 24->44 46 2 other processes 26->46 48 2 other processes 28->48 50 2 other processes 30->50 signatures8 process9 file10 70 C:\Users\user\AppData\Roaming\...\zip.dll, PE32 32->70 dropped 72 C:\Users\user\AppData\...\wsdetect.dll, PE32 32->72 dropped 74 C:\Users\user\AppData\...\w2k_lsa_auth.dll, PE32 32->74 dropped 76 128 other files (82 malicious) 32->76 dropped 52 conhost.exe 32->52         started        104 Creates autostart registry keys to launch java 35->104 54 conhost.exe 35->54         started        106 Detected ADWIND Rat 38->106 56 cscript.exe 1 42->56         started        58 cscript.exe 1 42->58         started        60 conhost.exe 42->60         started        62 5 other processes 42->62 signatures11 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/092de0bc5c72127a36d81e534114ee31af8829d8d8d4055c19ec9f4b36de69fd/
Threat name:
ByteCode-JAVA.Trojan.AdWind
Create hunting rule
Status:
Malicious
First seen:
2022-11-16 23:03:47 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bew6bpc4oijhunwydzjucfhoggxyqkoy3dkakxaz5spuwnw6nh6q._file
Result
Malware family:
adwind
Create hunting rule
Score:
  10/10
Tags:
family:adwind persistence trojan
Link:
https://tria.ge/reports/230328-rjzd7sdb2y/
Behaviour
Modifies registry key
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Drops file in System32 directory
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
AdWind
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/092de0bc5c72127a36d81e534114ee31af8829d8d8d4055c19ec9f4b36de69fd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/378193/

Comments