🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fd66117acabc88ce5fbdbf2be4ea3e80fbecf5a43236185cc264c52ba09c8d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adwind


Vendor detections: 6


Intelligence 6 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8fd66117acabc88ce5fbdbf2be4ea3e80fbecf5a43236185cc264c52ba09c8d8
SHA3-384 hash: e4164f8bf74ccf6215b9bf35766c06bebbe4d5ace1c57285d4106251b88b08bec108c7bf3492fff2086207d469a8118e
SHA1 hash: 9e81daa67c046e260551be4020d84b1fcf93a649
MD5 hash: 0e7ea3528c19b7d6ffb4e3223c63872a
humanhash: juliet-mirror-nuts-grey
File name:facture.jar
Download: download sample
Signature Adwind
Create hunting rule
File size:647'449 bytes
First seen:2021-06-08 22:33:39 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 12288:JQtWv5HqDqq467Yn0erf6JL0u61vbt67WB1+Ph6w1r:KtW9aqqX7q0Sf6NCTt6765K
TLSH 5DD42317CE6C9A55F0C84BEB7BE60E733109964059D46F438C9F2F6614CA8DB9C680BE
Reporter abuse_ch
Tags:Adwind jar


Avatar
abuse_ch
Adwind C2:
79.134.225.69:7551

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
79.134.225.69:7551 https://threatfox.abuse.ch/ioc/80302/

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'197
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/165488/
Detection(s):
SecuriteInfo.com.Artemis0E7EA3528C19.11600.6340.UNOFFICIAL
Create hunting rule

Result
Threat name:
ADWIND
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/799206
Signature
Antivirus detection for dropped file
Creates autostart registry keys to launch java
Detected ADWIND Rat
DLL side loading technique detected
Exploit detected, runtime environment starts unknown processes
Java source code contains strings found in CrossRAT
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Sigma detected: WScript or CScript Dropper
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses cmd line tools excessively to alter registry or file data
Uses regedit.exe to modify the Windows registry
Yara detected AdWind RATs dll
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 431602 Sample: facture.jar Startdate: 09/06/2021 Architecture: WINDOWS Score: 100 159 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->159 161 Malicious sample detected (through community Yara rule) 2->161 163 Antivirus detection for dropped file 2->163 165 8 other signatures 2->165 12 cmd.exe 2 2->12         started        14 javaw.exe 2->14         started        17 javaw.exe 2->17         started        process3 file4 19 java.exe 6 12->19         started        22 conhost.exe 12->22         started        145 C:\Users\...\Retrive9045432690419724852.vbs, ASCII 14->145 dropped 147 C:\Users\...\Retrive8700107707671719781.vbs, ASCII 14->147 dropped 24 java.exe 14->24         started        26 cmd.exe 14->26         started        149 C:\Users\...\Retrive3993101425707495840.vbs, ASCII 17->149 dropped 151 C:\Users\...\Retrive2164682142456942103.vbs, ASCII 17->151 dropped process5 file6 127 C:\Users\user\kiclbckzqz.js, ASCII 19->127 dropped 28 wscript.exe 3 3 19->28         started        32 icacls.exe 1 19->32         started        129 C:\Users\...\Retrive5752610235962376280.vbs, ASCII 24->129 dropped 131 C:\Users\...\Retrive5370200771753708707.vbs, ASCII 24->131 dropped 34 conhost.exe 24->34         started        36 conhost.exe 26->36         started        38 cscript.exe 26->38         started        process7 file8 139 C:\Users\user\...\ebgeaegdbdecaedfebace.reg, ASCII 28->139 dropped 173 Uses regedit.exe to modify the Windows registry 28->173 40 javaw.exe 26 28->40         started        45 regedit.exe 28->45         started        47 conhost.exe 32->47         started        signatures9 process10 dnsIp11 155 192.168.2.1 unknown unknown 40->155 133 C:\Users\user\...\hRRIvKIsZrc.MLeEhd, Java 40->133 dropped 135 C:\Users\...\Retrive687091938509327992.vbs, ASCII 40->135 dropped 137 C:\Users\...\Retrive5452612143778096749.vbs, ASCII 40->137 dropped 171 Uses cmd line tools excessively to alter registry or file data 40->171 49 javaw.exe 40->49         started        54 xcopy.exe 40->54         started        56 java.exe 13 40->56         started        58 6 other processes 40->58 file12 signatures13 process14 dnsIp15 153 79.134.225.69, 49746, 49754, 49775 FINK-TELECOM-SERVICESCH Switzerland 49->153 109 C:\Users\...\Windows3724596789244144941.dll, PE32 49->109 dropped 111 C:\Users\...\Retrive5810946664302959417.vbs, ASCII 49->111 dropped 113 C:\Users\...\Retrive360706698459658176.vbs, ASCII 49->113 dropped 167 Detected ADWIND Rat 49->167 60 java.exe 49->60         started        65 WMIC.exe 49->65         started        67 cmd.exe 49->67         started        75 4 other processes 49->75 115 C:\Users\user\AppData\Roaming\...\javaw.exe, PE32 54->115 dropped 117 C:\Users\user\AppData\Roaming\...\java.exe, PE32 54->117 dropped 119 C:\Users\user\AppData\Roaming\...\zip.dll, PE32 54->119 dropped 125 128 other files (none is malicious) 54->125 dropped 69 conhost.exe 54->69         started        121 C:\Users\...\Retrive964780673889099487.vbs, ASCII 56->121 dropped 123 C:\Users\...\Retrive5699309909042854410.vbs, ASCII 56->123 dropped 71 cmd.exe 56->71         started        73 cmd.exe 56->73         started        77 2 other processes 56->77 169 Creates autostart registry keys to launch java 58->169 79 9 other processes 58->79 file16 signatures17 process18 dnsIp19 157 127.0.0.1 unknown unknown 60->157 141 C:\Users\...\Retrive79369722678992139.vbs, ASCII 60->141 dropped 143 C:\Users\...\Retrive1802265535750686577.vbs, ASCII 60->143 dropped 175 Detected ADWIND Rat 60->175 81 cmd.exe 60->81         started        83 cmd.exe 60->83         started        85 cmd.exe 60->85         started        87 conhost.exe 60->87         started        177 DLL side loading technique detected 65->177 91 2 other processes 67->91 93 2 other processes 71->93 95 2 other processes 73->95 97 4 other processes 75->97 89 conhost.exe 77->89         started        file20 signatures21 process22 process23 99 conhost.exe 81->99         started        101 cscript.exe 81->101         started        103 conhost.exe 83->103         started        105 cscript.exe 83->105         started        107 conhost.exe 85->107         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8fd66117acabc88ce5fbdbf2be4ea3e80fbecf5a43236185cc264c52ba09c8d8/
Threat name:
Script.Downloader.BanLoad
Create hunting rule
Status:
Malicious
First seen:
2021-06-08 22:34:23 UTC
AV detection:
3 of 46 (6.52%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r7lgcf5mvpeizzp33pzl4tvd5ah35t22imrwdbomezgffoqjzdma._file
Result
Malware family:
adwind
Create hunting rule
Score:
  10/10
Tags:
family:adwind trojan
Link:
https://tria.ge/reports/210608-cnl9r7b66j/
Behaviour
Modifies registry class
Runs .reg file with regedit
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
AdWind
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Adwind
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8fd66117acabc88ce5fbdbf2be4ea3e80fbecf5a43236185cc264c52ba09c8d8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/165488/

Comments