MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6
SHA3-384 hash:	66b93486e8dfe5470f8a29b231f0ec681e0d1c963cd5fc8de37ef16caffc994efb0a3d5b067c8c0451a06e44ab5e3723
SHA1 hash:	3d0403ab389c056beae99b7e71cca51ad521c870
MD5 hash:	df2d12625998b7c51a4eab26d3a42e7e
humanhash:	echo-shade-nevada-ack
File name:	FACTURA.jar
Download:	download sample
Signature	Adwind Alert Create hunting rule
File size:	658'720 bytes
First seen:	2024-04-16 17:35:10 UTC
Last seen:	Never
File type:	jar
MIME type:	application/zip
ssdeep	12288:R/eAo7rK7tfAKc6Mr+DpxFGs/HfTeg1jPZc+AR6AptwyoFGVKBzG1KpUfsRxrq40:no7rKJcPr+wIHfzxcbTLwyoFuKBAURx4
TLSH	T157E433D09A76464F2778AF4B48924B2E626815F09BE6CC7E3F3374142C544CAB1DE0F6
TrID	72.9% (.JAR) Java Archive (13500/1/2) 21.6% (.ZIP) ZIP compressed archive (4000/1) 5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	abuse_ch
Tags:	Adwind jar

abuse_ch

Adwind C2:
103.151.123.225:5000

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

124

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6.jar

Verdict:

No threats detected

Analysis date:

2024-04-16 17:36:46 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/d07b5751-ffc8-4911-aa64-724faab792de

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Hybrid Analysis Java.Trojan.GenericA

Verdict:

Malicious

Labled as:

Java.Trojan.GenericA

Link:

https://www.hybrid-analysis.com/sample/380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6

Joe Sandbox ADWIND

Result

Threat name:

ADWIND

Alert

Create hunting rule

Detection:

malicious

Classification:

phis.troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1426949

Signature

Antivirus detection for dropped file

Creates a Image File Execution Options (IFEO) Debugger entry

Creates an undocumented autostart registry key

Detected ADWIND Rat

Disable UAC(promptonsecuredesktop)

Disables UAC (registry)

Disables Windows system restore

Disables zone checking for all users

Excessive usage of taskkill to terminate processes

Exploit detected, runtime environment starts unknown processes

Found suspicious ZIP file

Java source code contains strings found in CrossRAT

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Adwind RAT / JRAT File Artifact

Sigma detected: Potential Attachment Manager Settings Associations Tamper

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Processes Spawned by Java.EXE

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Uses regedit.exe to modify the Windows registry

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected AdWind RATs dll

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hagarq2hc526h3gnzu6hkuduiv7hzwx4alus46445kwywuaovcta._file

Hatching Triage adwind

Result

Malware family:

adwind

Alert

Create hunting rule

Score:

  10/10

Tags:

family:adwind discovery trojan

Link:

https://tria.ge/reports/240416-v6j5ksgc72/

Behaviour

Kills process with taskkill

Runs .reg file with regedit

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in System32 directory

Checks computer location settings

Modifies file permissions

AdWind

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/380c08c34717/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6