🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87ea2bbf1c44a8cd20685caca933204da658f3f36c2d83ed28c0cacdfe3ae7c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adwind


Vendor detections: 6


Intelligence 6 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87ea2bbf1c44a8cd20685caca933204da658f3f36c2d83ed28c0cacdfe3ae7c4
SHA3-384 hash: 57197c1a6332292cb17308e1b5244a48bbaeeaa82e9107d63d8f637df8909a5b7e8996d9d1dd3c6c4f1cfac3b617ae3d
SHA1 hash: af650477251542321e4b3e245567252cc829a991
MD5 hash: 989d10a027bb4df2ad1fbf4a65e3cef9
humanhash: shade-freddie-speaker-arizona
File name:Confirmation transfer MT103 Ref-99065001.js
Download: download sample
Signature Adwind
Create hunting rule
File size:912'100 bytes
First seen:2022-09-02 06:40:27 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 12288:FPko2DkK4t/ES+9DGuLqM6A6EfZjcEiDkcUaY1wn2+zef6HD91Bpg7lz4NwL/EMd:KBYfqauuld6c6muUe6l+BzdwT+
TLSH T1AF15F1309D40D7578F58323C63FE190BE7B84AE5A14E3246EB776D1BBBCB158920B258
Reporter abuse_ch
Tags:Adwind js


Avatar
abuse_ch
Adwind C2:
202.55.132.51:2256

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
202.55.132.51:2256 https://threatfox.abuse.ch/ioc/847338/

Intelligence

File Origin
# of uploads :
1
# of downloads :
396
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Packed.99.18432.22265.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/6311a582a7450371f69aeff4/reports/425fcdcd-7de6-4ae6-b969-2231a62caf2f/overview
Result
Threat name:
ADWIND
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1063752
Signature
Antivirus detection for dropped file
Creates autostart registry keys to launch java
Detected ADWIND Rat
Exploit detected, runtime environment starts unknown processes
Java source code contains strings found in CrossRAT
JavaScript source code contains functionality to generate code involving a shell, file or stream
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Uses cmd line tools excessively to alter registry or file data
Uses dynamic DNS services
Yara detected AdWind RAT
Yara detected AdWind RATs dll
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 696278 Sample: Confirmation transfer MT103... Startdate: 02/09/2022 Architecture: WINDOWS Score: 100 130 fresh01.ddns.net 2->130 134 Malicious sample detected (through community Yara rule) 2->134 136 Antivirus detection for dropped file 2->136 138 Detected ADWIND Rat 2->138 140 7 other signatures 2->140 11 wscript.exe 3 3 2->11         started        16 javaw.exe 2->16         started        18 javaw.exe 2->18         started        signatures3 process4 dnsIp5 132 192.168.2.1 unknown unknown 11->132 120 C:\Users\user\AppData\Roaming\ilNZFcyrxJ.js, ASCII 11->120 dropped 122 C:\Users\user\AppData\Roaming\brhnggsyy.txt, Java 11->122 dropped 150 JScript performs obfuscated calls to suspicious functions 11->150 20 javaw.exe 28 11->20         started        24 wscript.exe 11->24         started        124 C:\Users\...\Retrive5241488649295089052.vbs, ASCII 16->124 dropped 126 C:\Users\...\Retrive3475545825403862832.vbs, ASCII 16->126 dropped 26 java.exe 16->26         started        28 cmd.exe 16->28         started        128 C:\Users\...\Retrive5235776684256493730.vbs, ASCII 18->128 dropped 30 java.exe 18->30         started        file6 signatures7 process8 file9 108 C:\Users\user\...\HITxLMUpQsZ.RdBCTk, Java 20->108 dropped 110 C:\Users\...\Retrive2594199611255273070.vbs, ASCII 20->110 dropped 112 C:\Users\...\Retrive1667111510264535806.vbs, ASCII 20->112 dropped 146 Uses cmd line tools excessively to alter registry or file data 20->146 32 xcopy.exe 20->32         started        35 javaw.exe 20->35         started        38 java.exe 13 20->38         started        48 7 other processes 20->48 114 C:\Users\...\Retrive5362730492726551773.vbs, ASCII 26->114 dropped 40 conhost.exe 26->40         started        42 conhost.exe 28->42         started        44 cscript.exe 28->44         started        46 conhost.exe 30->46         started        signatures10 process11 file12 92 C:\Users\user\AppData\Roaming\...\javaw.exe, PE32 32->92 dropped 94 C:\Users\user\AppData\Roaming\...\java.exe, PE32 32->94 dropped 96 C:\Users\user\AppData\Roaming\...\zip.dll, PE32 32->96 dropped 106 128 other files (none is malicious) 32->106 dropped 50 conhost.exe 32->50         started        98 C:\Users\...\Retrive8242713998738834400.vbs, ASCII 35->98 dropped 100 C:\Users\...\Retrive3480397254372612239.vbs, ASCII 35->100 dropped 142 Detected ADWIND Rat 35->142 52 java.exe 35->52         started        56 cmd.exe 35->56         started        58 cmd.exe 35->58         started        102 C:\Users\...\Retrive3994964565877636545.vbs, ASCII 38->102 dropped 104 C:\Users\...\Retrive3004032921061536549.vbs, ASCII 38->104 dropped 60 cmd.exe 1 38->60         started        62 cmd.exe 38->62         started        64 xcopy.exe 38->64         started        66 conhost.exe 38->66         started        144 Creates autostart registry keys to launch java 48->144 68 9 other processes 48->68 signatures13 process14 file15 116 C:\Users\...\Retrive5698177065685479236.vbs, ASCII 52->116 dropped 118 C:\Users\...\Retrive1332428907882785410.vbs, ASCII 52->118 dropped 148 Detected ADWIND Rat 52->148 70 cmd.exe 52->70         started        72 conhost.exe 52->72         started        84 2 other processes 56->84 86 2 other processes 58->86 74 cscript.exe 1 60->74         started        76 conhost.exe 60->76         started        78 conhost.exe 62->78         started        80 cscript.exe 62->80         started        82 conhost.exe 64->82         started        signatures16 process17 process18 88 conhost.exe 70->88         started        90 cscript.exe 70->90         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87ea2bbf1c44a8cd20685caca933204da658f3f36c2d83ed28c0cacdfe3ae7c4/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-09-02 06:41:08 UTC
File Type:
Text (JavaScript)
AV detection:
6 of 21 (28.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q7vcxpy4isum2idilswksmzajwtfr47tnqwyh3jiydfm37r247ca._file
Result
Malware family:
adwind
Create hunting rule
Score:
  10/10
Tags:
family:adwind trojan
Link:
https://tria.ge/reports/220902-hfsb2shfdq/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
AdWind
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/87ea2bbf1c44a8cd20685caca933204da658f3f36c2d83ed28c0cacdfe3ae7c4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments