🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13510f3ee14e47e2fc457215420e795f0959e33411e4fa2e8a889a3c7fb858d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adwind


Vendor detections: 6


Intelligence 6 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13510f3ee14e47e2fc457215420e795f0959e33411e4fa2e8a889a3c7fb858d9
SHA3-384 hash: 53a840676d46bddb5642c334f86cd74d0237cae5a9b181d129c058ba7cb8fa45390f839888ed997b61a12e8f4dec8ed9
SHA1 hash: 1c8af842bda12c315b7a78b4a44f3c4e8a1721a9
MD5 hash: c67d02c567461d6fad607a89ac1084b8
humanhash: lima-purple-oranges-twelve
File name:1073645267891287347.jar
Download: download sample
Signature Adwind
Create hunting rule
File size:490'742 bytes
First seen:2021-08-31 11:25:05 UTC
Last seen:Never
File type:Java file jar
MIME type:application/java-archive
ssdeep 12288:xDv1xLOe9bWHgmYrmduL5pxogQNUhIK/0c2qnAl:xDvfj91NKd0sS7B2qnK
TLSH T19FA4126DFBAD9428E3E3A43010C544C667B52C98E3C184728D7236A753799B3DB23AF5
Reporter abuse_ch
Tags:Adwind jar


Avatar
abuse_ch
Adwind C2:
172.93.187.66:19844

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
172.93.187.66:19844 https://threatfox.abuse.ch/ioc/202459/

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'815
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1073645267891287347.jar
Verdict:
Malicious activity
Analysis date:
2021-08-31 11:28:21 UTC
Tags:
adwind trojan
Link:
https://app.any.run/tasks/212bf71f-e991-4c5b-a88e-9a0ec6f65d05

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/184176/
Detection(s):
Java.Trojan.Adwind-6
Create hunting rule

Sanesecurity.Malware.26455.JRat.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Adwind.657.13483.20347.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Agent-12.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Jrat-1.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Jrat.158.31844.8698.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JRat-1.UNOFFICIAL
Create hunting rule

Result
Threat name:
ADWIND
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/842550
Signature
Antivirus detection for dropped file
Collects Antivirus and Firewall information (ADWIND Rat suspicion)
Creates autostart registry keys to launch java
Detected ADWIND Rat
Exploit detected, runtime environment starts unknown processes
Found Adwind RAT configuration as decrypted string
Java Jar changes file attribute to hide it from user
Java Jar creates autostart registry key (Windows persistence behavior)
Java source code contains strings found in CrossRAT
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses cmd line tools excessively to alter registry or file data
Uses regedit.exe to modify the Windows registry
Yara detected AdWind RAT
Yara detected AdWind RATs dll
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 474984 Sample: 1073645267891287347.jar Startdate: 31/08/2021 Architecture: WINDOWS Score: 100 92 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->92 94 Malicious sample detected (through community Yara rule) 2->94 96 Antivirus detection for dropped file 2->96 98 14 other signatures 2->98 9 cmd.exe 2 2->9         started        12 javaw.exe 2->12         started        process3 dnsIp4 102 Uses regedit.exe to modify the Windows registry 9->102 16 java.exe 19 9->16         started        21 conhost.exe 9->21         started        90 172.93.187.66, 19844, 49729, 49743 ASN-QUADRANET-GLOBALUS United States 12->90 80 C:\Users\...\Windows7406189413926470509.dll, PE32 12->80 dropped 82 C:\Users\...\Retrive5550641601091136023.vbs, ASCII 12->82 dropped 84 C:\Users\...\Retrive1903185419511731667.vbs, ASCII 12->84 dropped file5 signatures6 process7 dnsIp8 86 192.168.2.1 unknown unknown 16->86 62 C:\Users\user\...\voYZHMSwtjQ.PdyglH, Java 16->62 dropped 64 C:\Users\...\Retrive7121421701957189679.vbs, ASCII 16->64 dropped 66 C:\Users\...\Retrive5998551291182328150.vbs, ASCII 16->66 dropped 100 Uses cmd line tools excessively to alter registry or file data 16->100 23 xcopy.exe 16->23         started        26 java.exe 17 16->26         started        29 reg.exe 16->29         started        32 7 other processes 16->32 file9 signatures10 process11 dnsIp12 68 C:\Users\user\AppData\Roaming\...\javaw.exe, PE32 23->68 dropped 70 C:\Users\user\AppData\Roaming\...\zip.dll, PE32 23->70 dropped 72 C:\Users\user\AppData\...\wsdetect.dll, PE32 23->72 dropped 78 128 other files (none is malicious) 23->78 dropped 34 conhost.exe 23->34         started        88 127.0.0.1 unknown unknown 26->88 74 C:\Users\...\Retrive9140049499648932111.vbs, ASCII 26->74 dropped 76 C:\Users\...\Retrive129882353974860806.vbs, ASCII 26->76 dropped 36 cmd.exe 1 26->36         started        38 cmd.exe 26->38         started        40 cmd.exe 26->40         started        42 conhost.exe 26->42         started        104 Creates autostart registry keys to launch java 29->104 44 conhost.exe 29->44         started        46 cscript.exe 1 32->46         started        48 cscript.exe 1 32->48         started        50 6 other processes 32->50 file13 signatures14 process15 process16 52 cscript.exe 1 36->52         started        54 conhost.exe 36->54         started        56 conhost.exe 38->56         started        58 cscript.exe 38->58         started        60 conhost.exe 40->60         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13510f3ee14e47e2fc457215420e795f0959e33411e4fa2e8a889a3c7fb858d9/
Threat name:
ByteCode-JAVA.Trojan.AdWind
Create hunting rule
Status:
Malicious
First seen:
2021-08-31 11:25:09 UTC
AV detection:
29 of 41 (70.73%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cniq6pxbjzd6f7cfoikuedtzl4evtyzuchspulukrcndy75yldmq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210831-sfwqd7y172/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/13510f3ee14e47e2fc457215420e795f0959e33411e4fa2e8a889a3c7fb858d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_JRAT_Oct18_1
Create hunting rule
Author:Florian Roth
Description:Detects JRAT malware
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/184176/

Comments