🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b497ad1ec1cc4c7ea45b070c2cb3f2f78b0f06e128225df43980abd05d9fb1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adwind


Vendor detections: 6


Intelligence 6 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b497ad1ec1cc4c7ea45b070c2cb3f2f78b0f06e128225df43980abd05d9fb1e
SHA3-384 hash: ddd0fb40930919ce124c9f468a7762b4f7f4c5f51d3401c0be94af5ae7286c05e0527c66bcece45018c425f2e0d160a2
SHA1 hash: aa84655568ea4727d742c13b10f8d159ee7926e6
MD5 hash: 4529ccc406e6fc95f2dcdc5f6bae28a5
humanhash: edward-lamp-eighteen-golf
File name:TellerAdvice.jar
Download: download sample
Signature Adwind
Create hunting rule
File size:641'068 bytes
First seen:2022-08-24 07:10:35 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 12288:UPNuogFSuOJlMO4r8ajpm3AI8u0BxuPTNHVWPK0U6qTaDYZXUr11CO004gaOezNk:UPQoXumMO4r8Am301BUPTN1WPK0UhTa1
TLSH T14CD4330A1A24300CCEFB39DCB8B6365693B7DA49557393AE7E16BF15B71C1968863C08
TrID 72.9% (.JAR) Java Archive (13500/1/2)
21.6% (.ZIP) ZIP compressed archive (4000/1)
5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter abuse_ch
Tags:Adwind jar


Avatar
abuse_ch
Adwind C2:
46.183.220.114:44147

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
46.183.220.114:44147 https://threatfox.abuse.ch/ioc/845097/

Intelligence

File Origin
# of uploads :
1
# of downloads :
292
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
TellerAdvice.jar
Verdict:
No threats detected
Analysis date:
2022-08-24 07:13:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0430fad7-6a16-40e3-ab36-df9ddf925245

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/300755/
Detection(s):
SecuriteInfo.com.Java.Muldrop.37.9488.19256.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6305cf7f393b1c8c470bc539/reports/d10b46d9-ae1c-4d0d-843e-d370b4b8f1b8/overview
Result
Threat name:
ADWIND
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1056789
Signature
Antivirus detection for dropped file
Detected ADWIND Rat
Exploit detected, runtime environment starts unknown processes
Java source code contains strings found in CrossRAT
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Yara detected AdWind RAT
Yara detected AdWind RATs dll
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 689306 Sample: TellerAdvice.jar Startdate: 24/08/2022 Architecture: WINDOWS Score: 88 83 snkcyp.duckdns.org 2->83 87 Antivirus detection for dropped file 2->87 89 Detected ADWIND Rat 2->89 91 Yara detected AdWind RATs dll 2->91 93 5 other signatures 2->93 12 cmd.exe 2 2->12         started        signatures3 process4 process5 14 java.exe 6 12->14         started        16 conhost.exe 12->16         started        process6 18 wscript.exe 3 3 14->18         started        20 icacls.exe 1 14->20         started        process7 22 javaw.exe 22 18->22         started        26 wscript.exe 18->26         started        28 conhost.exe 20->28         started        dnsIp8 85 192.168.2.1 unknown unknown 22->85 67 C:\Users\...\Retrive6605054186579260291.vbs, ASCII 22->67 dropped 69 C:\Users\...\Retrive2505556739028009559.vbs, ASCII 22->69 dropped 30 xcopy.exe 22->30         started        33 java.exe 13 22->33         started        35 cmd.exe 1 22->35         started        37 cmd.exe 1 22->37         started        file9 process10 file11 71 C:\Users\user\AppData\Roaming\...\zip.dll, PE32 30->71 dropped 73 C:\Users\user\AppData\...\wsdetect.dll, PE32 30->73 dropped 75 C:\Users\user\AppData\...\w2k_lsa_auth.dll, PE32 30->75 dropped 81 128 other files (none is malicious) 30->81 dropped 39 conhost.exe 30->39         started        77 C:\Users\...\Retrive7713592904461667083.vbs, ASCII 33->77 dropped 79 C:\Users\...\Retrive4774854000948861344.vbs, ASCII 33->79 dropped 41 cmd.exe 1 33->41         started        43 cmd.exe 33->43         started        45 xcopy.exe 33->45         started        47 conhost.exe 33->47         started        49 cscript.exe 1 35->49         started        51 conhost.exe 35->51         started        53 conhost.exe 37->53         started        55 cscript.exe 1 37->55         started        process12 process13 57 conhost.exe 41->57         started        59 cscript.exe 41->59         started        61 conhost.exe 43->61         started        63 cscript.exe 43->63         started        65 conhost.exe 45->65         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b497ad1ec1cc4c7ea45b070c2cb3f2f78b0f06e128225df43980abd05d9fb1e/
Threat name:
ByteCode-JAVA.Trojan.AdWind
Create hunting rule
Status:
Malicious
First seen:
2022-08-24 07:11:06 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
13 of 41 (31.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fnexvupmdtcmp2sfwbymfsz7f54lb4dockbclx2dtafl2boz7mpa._file
Result
Malware family:
adwind
Create hunting rule
Score:
  10/10
Tags:
family:adwind persistence trojan
Link:
https://tria.ge/reports/220824-hzx2mshhel/
Behaviour
Modifies registry class
Modifies registry key
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
AdWind
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/2b497ad1ec1cc4c7ea45b070c2cb3f2f78b0f06e128225df43980abd05d9fb1e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/300755/

Comments