MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59ea95bf89900dadb2e085d910bd72f71239a11b01c7f4c5e8feb0aea1a2c1d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	59ea95bf89900dadb2e085d910bd72f71239a11b01c7f4c5e8feb0aea1a2c1d9
SHA3-384 hash:	024156a8061e296f3c15ac719779bca7a966c2490fa0c9f6c1b7daf8ddc9572cad74f8e994317a78a9e34f7e9f9d4590
SHA1 hash:	1153c96b460ca99ecb21fd4eb3b90919ba827e90
MD5 hash:	979ba6af6f6adf0930ab75ecea1b450f
humanhash:	cardinal-chicken-iowa-beer
File name:	FEDEX-TNT OVERDUE UNPAID INVOICE980055177856..jar
Download:	download sample
Signature	Adwind Alert Create hunting rule
File size:	649'679 bytes
First seen:	2024-04-16 16:10:12 UTC
Last seen:	Never
File type:	jar
MIME type:	application/zip
ssdeep	12288:FkQrFVhCTXI38nXLt1+VmnBcN+b/bYBGs4Ty0qZBZUjWzdNkE7LKJU27DG:v/hkYWbtqmnucbFIUjWzdJLKJU27DG
TLSH	T142D4230ECD6A6487B81943BDE9363625EC5549E7FE90C6134C0C4E2D0AB2FD5CA7B1B2
TrID	72.9% (.JAR) Java Archive (13500/1/2) 21.6% (.ZIP) ZIP compressed archive (4000/1) 5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	abuse_ch
Tags:	Adwind jar

abuse_ch

Adwind C2:
103.151.123.225:5000

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

124

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

59ea95bf89900dadb2e085d910bd72f71239a11b01c7f4c5e8feb0aea1a2c1d9.jar

Verdict:

No threats detected

Analysis date:

2024-04-16 16:24:45 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0a4a7225-21d1-4a9b-8fd0-cd5505c63e0a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

masquerade obfuscated

Link:

https://www.filescan.io/uploads/661ea32054bafb7d21cf132d/reports/eaa97e8f-69d8-4b6a-8ef9-51fc80bd8ffd/overview

Hybrid Analysis Java.Trojan.GenericA

Verdict:

Malicious

Labled as:

Java.Trojan.GenericA

Link:

https://www.hybrid-analysis.com/sample/59ea95bf89900dadb2e085d910bd72f71239a11b01c7f4c5e8feb0aea1a2c1d9

Joe Sandbox ADWIND

Result

Threat name:

ADWIND

Alert

Create hunting rule

Detection:

malicious

Classification:

phis.troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1426905

Signature

Antivirus detection for dropped file

Creates a Image File Execution Options (IFEO) Debugger entry

Creates an undocumented autostart registry key

Detected ADWIND Rat

Disable UAC(promptonsecuredesktop)

Disables UAC (registry)

Disables Windows system restore

Disables zone checking for all users

Excessive usage of taskkill to terminate processes

Exploit detected, runtime environment starts unknown processes

Java source code contains strings found in CrossRAT

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Adwind RAT / JRAT File Artifact

Sigma detected: Potential Attachment Manager Settings Associations Tamper

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Processes Spawned by Java.EXE

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Uses regedit.exe to modify the Windows registry

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected AdWind RATs dll

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/59ea95bf89900dadb2e085d910bd72f71239a11b01c7f4c5e8feb0aea1a2c1d9

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/59ea95bf89900dadb2e085d910bd72f71239a11b01c7f4c5e8feb0aea1a2c1d9/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lhvjlp4jsag23mxaqxmrbpls64jdtii3ahd7jrpi72yk5incyhmq._file

Hatching Triage adwind

Result

Malware family:

adwind

Alert

Create hunting rule

Score:

  10/10

Tags:

family:adwind discovery evasion persistence trojan

Link:

https://tria.ge/reports/240416-tmx2naed98/

Behaviour

Kills process with taskkill

Runs .reg file with regedit

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in System32 directory

Checks computer location settings

Modifies file permissions

Disables use of System Restore points

Sets file execution options in registry

AdWind

UAC bypass

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/59ea95bf8990/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Adwind

Threat name:

Adwind

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/59ea95bf89900dadb2e085d910bd72f71239a11b01c7f4c5e8feb0aea1a2c1d9