🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f4b5467cccbbc2f2c5771d9547e7fca350df341d154f4d83a4442b7a44cdf06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adwind


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f4b5467cccbbc2f2c5771d9547e7fca350df341d154f4d83a4442b7a44cdf06
SHA3-384 hash: 29dcb562dd92a7067b55dd734b62914555df9300d145613e40c330a2f44fde9073330a734fc49367722ac112e8912f3c
SHA1 hash: 987634d53966aa6e84c72ad366bb78e619cb674a
MD5 hash: 5bca887380e1881f351c22574d257e41
humanhash: princess-four-cat-robert
File name:gcahfpmhcn.js
Download: download sample
Signature Adwind
Create hunting rule
File size:1'031'156 bytes
First seen:2024-04-16 17:54:39 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 12288:k5hvpTSH6kI3/VITSZjbZkgdciA5Y0y9BY7BA0Et5YdtFpGzN3w1xYZWkTSP4Wn:kXpWH9eZZjdkeCjmlY3FeNgwuP4G
TLSH T1B6257CEA9584172EEB74100591AB2FAF62E0EF4F7225C85FA1BA1FCFFB2551C461424C
Reporter NDA0
Tags:Adwind js


Avatar
NDA0
C2: pnauco5.ddns.net:5000 | 103.151.123.225:5000

Intelligence

File Origin
# of uploads :
1
# of downloads :
420
Origin country :
NL NL
Vendor Threat Intelligence
Verdict:
Malicious
Labled as:
TrojanDropper/JS.Agent
Link:
https://www.hybrid-analysis.com/sample/5f4b5467cccbbc2f2c5771d9547e7fca350df341d154f4d83a4442b7a44cdf06
Result
Threat name:
ADWIND
Create hunting rule
Detection:
malicious
Classification:
phis.troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1426956
Signature
Antivirus detection for dropped file
Creates a Image File Execution Options (IFEO) Debugger entry
Creates an undocumented autostart registry key
Detected ADWIND Rat
Disable UAC(promptonsecuredesktop)
Disables UAC (registry)
Disables Windows system restore
Disables zone checking for all users
Excessive usage of taskkill to terminate processes
Exploit detected, runtime environment starts unknown processes
Found suspicious ZIP file
Java source code contains strings found in CrossRAT
JavaScript source code contains functionality to generate code involving a shell, file or stream
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Sigma detected: Adwind RAT / JRAT File Artifact
Sigma detected: Potential Attachment Manager Settings Associations Tamper
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses regedit.exe to modify the Windows registry
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected AdWind RAT
Yara detected AdWind RATs dll
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1426956 Sample: gcahfpmhcn.js Startdate: 16/04/2024 Architecture: WINDOWS Score: 100 81 pnauco5.ddns.net 2->81 99 Malicious sample detected (through community Yara rule) 2->99 101 Antivirus detection for dropped file 2->101 103 Multi AV Scanner detection for dropped file 2->103 107 13 other signatures 2->107 10 wscript.exe 1 2 2->10         started        signatures3 105 Uses dynamic DNS services 81->105 process4 file5 71 C:\Users\user\AppData\Roaming\cmukyspiy.txt, Java 10->71 dropped 109 JScript performs obfuscated calls to suspicious functions 10->109 111 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->111 14 javaw.exe 29 10->14         started        signatures6 process7 dnsIp8 85 pnauco5.ddns.net 103.151.123.225, 49744, 5000 VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN unknown 14->85 73 C:\Users\...\Windows197633722729995093.dll, PE32 14->73 dropped 75 C:\Users\...\XGkhOkmDsC474469576599115670.reg, ASCII 14->75 dropped 77 C:\Users\...\Retrive8340316412854535662.vbs, ASCII 14->77 dropped 79 C:\Users\...\Retrive6110391193418258336.vbs, ASCII 14->79 dropped 87 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 14->87 89 Excessive usage of taskkill to terminate processes 14->89 19 xcopy.exe 14->19         started        22 cmd.exe 14->22         started        24 java.exe 12 14->24         started        27 23 other processes 14->27 file9 signatures10 process11 dnsIp12 59 C:\Users\user\AppData\Roaming\...\zip.dll, PE32 19->59 dropped 61 C:\Users\user\AppData\...\wsdetect.dll, PE32 19->61 dropped 63 C:\Users\user\AppData\...\w2k_lsa_auth.dll, PE32 19->63 dropped 69 132 other malicious files 19->69 dropped 30 conhost.exe 19->30         started        32 regedit.exe 22->32         started        45 3 other processes 22->45 83 127.0.0.1 unknown unknown 24->83 65 C:\Users\...\Retrive4329570775648502228.vbs, ASCII 24->65 dropped 67 C:\Users\...\Retrive4143913798509633277.vbs, ASCII 24->67 dropped 35 cmd.exe 1 24->35         started        37 cmd.exe 24->37         started        39 xcopy.exe 24->39         started        41 conhost.exe 24->41         started        113 Uses regedit.exe to modify the Windows registry 27->113 43 cscript.exe 1 27->43         started        47 24 other processes 27->47 file13 signatures14 process15 signatures16 91 Creates an undocumented autostart registry key 32->91 93 Disables zone checking for all users 32->93 95 Creates a Image File Execution Options (IFEO) Debugger entry 32->95 97 3 other signatures 32->97 49 cscript.exe 1 35->49         started        51 conhost.exe 35->51         started        53 conhost.exe 37->53         started        55 cscript.exe 37->55         started        57 conhost.exe 39->57         started        process17
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5f4b5467cccbbc2f2c5771d9547e7fca350df341d154f4d83a4442b7a44cdf06
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f4b5467cccbbc2f2c5771d9547e7fca350df341d154f4d83a4442b7a44cdf06/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l5fviz6mzo6c6lcxohmvi7t7zi2q342b2fkpjwb2irblpjcm34da._file
Result
Malware family:
adwind
Create hunting rule
Score:
  10/10
Tags:
family:adwind discovery trojan
Link:
https://tria.ge/reports/240416-whe2dsab7y/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Checks computer location settings
Modifies file permissions
AdWind
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5f4b5467cccbbc2f2c5771d9547e7fca350df341d154f4d83a4442b7a44cdf06

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Adwind

Java file jar 380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6

Adwind

Java Script (JS) js 5f4b5467cccbbc2f2c5771d9547e7fca350df341d154f4d83a4442b7a44cdf06

(this sample)

  
Dropped by
SHA256 380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6
  
Dropped by
MD5 df2d12625998b7c51a4eab26d3a42e7e

Comments