🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30a050dca6550a8279dc7a7eeefb8f16025f6ab2cd3f6a0f0b15550cf487af33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adwind


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30a050dca6550a8279dc7a7eeefb8f16025f6ab2cd3f6a0f0b15550cf487af33
SHA3-384 hash: 7ffc83e63f6beaffda85af3a3966ed3d5d034ea573010344d64cef119d4a6cca1f38d233d8a9eede9ae1a0c7695c538f
SHA1 hash: 4759d8134d88c076d7b93d6d984b45915b798366
MD5 hash: f73655137d31b28ca9e1ec01d2b54e54
humanhash: island-crazy-batman-oscar
File name:Overdue invoices.jar
Download: download sample
Signature Adwind
Create hunting rule
File size:647'532 bytes
First seen:2022-12-04 18:30:11 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 12288:Rx4nDXAnbeyWWW4KqM6XeHKZd1QlcfzwZGwe7j2rj31x31VUST4BZetgTosCHC:RVbdWz6uHKZd1UuFBH2rDX1eST4SWkBi
TLSH T165D423BED1C44A66D070D17A62EF0CC020A61F26C097DF409AD87D99DBE4CE93E7954E
TrID 72.9% (.JAR) Java Archive (13500/1/2)
21.6% (.ZIP) ZIP compressed archive (4000/1)
5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter abuse_ch
Tags:Adwind jar


Avatar
abuse_ch
Adwind C2:
194.180.48.197:8123

Intelligence

File Origin
# of uploads :
1
# of downloads :
181
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Overdue invoices.jar
Verdict:
No threats detected
Analysis date:
2022-12-04 18:31:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3ba4ab01-b7d1-45a6-bc62-038a26287142

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/342608/
Detection(s):
SecuriteInfo.com.JS.Kryptik.CJF.tr.6061.8744.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/638ce7670c6473d16719727f/reports/e99978a5-6ca8-4aa9-8524-88822d656f81/overview
Result
Threat name:
ADWIND
Create hunting rule
Detection:
malicious
Classification:
troj.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1127553
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates autostart registry keys to launch java
Detected ADWIND Rat
Exploit detected, runtime environment starts unknown processes
Java source code contains strings found in CrossRAT
Malicious sample detected (through community Yara rule)
Sigma detected: Register Jar In Run Key
Uses cmd line tools excessively to alter registry or file data
Yara detected AdWind RAT
Yara detected AdWind RATs dll
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 760277 Sample: Overdue invoices.jar Startdate: 04/12/2022 Architecture: WINDOWS Score: 100 93 Malicious sample detected (through community Yara rule) 2->93 95 Antivirus detection for URL or domain 2->95 97 Antivirus detection for dropped file 2->97 99 7 other signatures 2->99 11 cmd.exe 2 2->11         started        process3 process4 13 java.exe 6 11->13         started        15 conhost.exe 11->15         started        process5 17 wscript.exe 2 13->17         started        20 icacls.exe 1 13->20         started        file6 69 C:\Users\user\AppData\...\kwsximokur.txt, Java 17->69 dropped 22 javaw.exe 26 17->22         started        27 conhost.exe 20->27         started        process7 dnsIp8 91 192.168.2.1 unknown unknown 22->91 71 C:\Users\user\JVlpBjOuqsQ\.jar.Bttolj, Java 22->71 dropped 73 C:\Users\...\Retrive756314445052936394.vbs, ASCII 22->73 dropped 75 C:\Users\...\Retrive1049889988249519062.vbs, ASCII 22->75 dropped 105 Uses cmd line tools excessively to alter registry or file data 22->105 29 xcopy.exe 22->29         started        32 java.exe 13 22->32         started        34 javaw.exe 22->34         started        37 6 other processes 22->37 file9 signatures10 process11 file12 77 C:\Users\user\AppData\Roaming\...\zip.dll, PE32 29->77 dropped 79 C:\Users\user\AppData\...\wsdetect.dll, PE32 29->79 dropped 81 C:\Users\user\AppData\...\w2k_lsa_auth.dll, PE32 29->81 dropped 89 128 other files (82 malicious) 29->89 dropped 39 conhost.exe 29->39         started        83 C:\Users\...\Retrive5413506321257697014.vbs, ASCII 32->83 dropped 85 C:\Users\...\Retrive4263841609931792093.vbs, ASCII 32->85 dropped 41 cmd.exe 32->41         started        43 cmd.exe 32->43         started        45 xcopy.exe 32->45         started        47 conhost.exe 32->47         started        87 C:\Users\...\Retrive2823556036478417977.vbs, ASCII 34->87 dropped 101 Detected ADWIND Rat 34->101 49 java.exe 34->49         started        103 Creates autostart registry keys to launch java 37->103 51 cscript.exe 1 37->51         started        53 conhost.exe 37->53         started        55 6 other processes 37->55 signatures13 process14 process15 57 conhost.exe 41->57         started        59 cscript.exe 41->59         started        61 conhost.exe 43->61         started        63 cscript.exe 43->63         started        65 conhost.exe 45->65         started        67 conhost.exe 49->67         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30a050dca6550a8279dc7a7eeefb8f16025f6ab2cd3f6a0f0b15550cf487af33/
Threat name:
ByteCode-JAVA.Trojan.AdWind
Create hunting rule
Status:
Malicious
First seen:
2022-12-04 18:31:08 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
16 of 40 (40.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gcqfbxfgkufie6o4pj7o564pcybf62vszu7wudylcvkqz5ehv4zq._file
Result
Malware family:
adwind
Create hunting rule
Score:
  10/10
Tags:
family:adwind trojan
Link:
https://tria.ge/reports/221204-w52tnseb87/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
AdWind
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/30a050dca6550a8279dc7a7eeefb8f16025f6ab2cd3f6a0f0b15550cf487af33

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/342608/

Comments