🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd8e3b2b93b70cc405accd3a69eebeb15f3f9d0e893fba8e95deec8edf0de615. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 4


Intelligence 4 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd8e3b2b93b70cc405accd3a69eebeb15f3f9d0e893fba8e95deec8edf0de615
SHA3-384 hash: ddb2aa1e33d4e6d7c3f37f3ef04be70cc3d94ed907cc3d81f3283450cad19f3d1ea638f451d41a6705d3e3a1f46ba6b7
SHA1 hash: ea8112accab09197fd8ba06a2b9b9912f8bc21f8
MD5 hash: 60bb5c076ca1ddd382213c4439a31735
humanhash: south-summer-kilo-arizona
File name:PO090620219.jar
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:643'615 bytes
First seen:2021-09-06 14:49:43 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 12288:WdzEm+qjRkRMEwA2uYEin+g1ceVCEGo+mnkUbQhdZBv/LEGA24uHOL97DmAwpLsi:WdEmFkRMEJYXn+feV/G2kUEhdZ1Pouu8
TLSH T1D7D423EBD76AB78DA544185E653369978D22C8C7473893CA5661BCCB86C30A7B08C34F
Reporter abuse_ch
Tags:jar vjw0rm

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
109.248.144.177:1947 https://threatfox.abuse.ch/ioc/216765/

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO090620219.jar
Verdict:
No threats detected
Analysis date:
2021-09-06 14:50:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4db55cac-babf-42bb-8d28-74594585b828

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/185690/
Detection(s):
SecuriteInfo.com.JS.Muldrop.737.25243.11816.UNOFFICIAL
Create hunting rule

Result
Threat name:
ADWIND
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/846058
Signature
Antivirus detection for dropped file
Creates autostart registry keys to launch java
Creates multiple autostart registry keys
Detected ADWIND Rat
Drops script or batch files to the startup folder
Exploit detected, runtime environment starts unknown processes
Java source code contains strings found in CrossRAT
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses cmd line tools excessively to alter registry or file data
Uses regedit.exe to modify the Windows registry
Yara detected AdWind RAT
Yara detected AdWind RATs dll
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 478489 Sample: PO090620219.jar Startdate: 06/09/2021 Architecture: WINDOWS Score: 100 124 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->124 126 Malicious sample detected (through community Yara rule) 2->126 128 Antivirus detection for dropped file 2->128 130 13 other signatures 2->130 11 cmd.exe 2 2->11         started        14 wscript.exe 2->14         started        17 wscript.exe 2->17         started        19 wscript.exe 2->19         started        process3 dnsIp4 134 Uses regedit.exe to modify the Windows registry 11->134 22 java.exe 6 11->22         started        25 conhost.exe 11->25         started        118 gameserver-789.duia.ro 14->118 136 System process connects to network (likely due to code injection or exploit) 14->136 138 Drops script or batch files to the startup folder 14->138 140 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 14->140 120 gameserver-789.duia.ro 17->120 142 Creates multiple autostart registry keys 17->142 122 gameserver-789.duia.ro 19->122 84 C:\Users\user\AppData\...\tuFLEDLWlO.js, ASCII 19->84 dropped file5 signatures6 process7 file8 86 C:\Users\user\husqbdmskg.js, ASCII 22->86 dropped 27 wscript.exe 3 3 22->27         started        30 icacls.exe 1 22->30         started        process9 signatures10 144 Drops script or batch files to the startup folder 27->144 146 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 27->146 32 javaw.exe 26 27->32         started        37 wscript.exe 2 13 27->37         started        39 conhost.exe 30->39         started        process11 dnsIp12 110 192.168.2.1 unknown unknown 32->110 78 C:\Users\user\...\HxfZSosuWHa.XGYvkg, Java 32->78 dropped 80 C:\Users\...\Retrive2069841797510538624.vbs, ASCII 32->80 dropped 82 C:\Users\...\Retrive1365577389842202087.vbs, ASCII 32->82 dropped 132 Uses cmd line tools excessively to alter registry or file data 32->132 41 xcopy.exe 32->41         started        44 javaw.exe 32->44         started        48 reg.exe 32->48         started        50 6 other processes 32->50 112 gameserver-789.duia.ro 23.105.131.203, 49712, 49713, 49714 LEASEWEB-USA-NYC-11US United States 37->112 file13 signatures14 process15 dnsIp16 92 C:\Users\user\AppData\Roaming\...\javaw.exe, PE32 41->92 dropped 94 C:\Users\user\AppData\Roaming\...\zip.dll, PE32 41->94 dropped 108 129 other files (none is malicious) 41->108 dropped 52 conhost.exe 41->52         started        116 109.248.144.177, 1947, 49733, 49740 DATACLUB-SE Russian Federation 44->116 96 C:\Users\...\Windows1618126281466100880.dll, PE32 44->96 dropped 98 C:\Users\...\Retrive7867047681921817929.vbs, ASCII 44->98 dropped 100 C:\Users\...\Retrive4746541536750447554.vbs, ASCII 44->100 dropped 102 C:\...behaviorgraphPKdKnuRsp4175715846255857274.reg, ASCII 44->102 dropped 148 Detected ADWIND Rat 44->148 54 java.exe 44->54         started        150 Creates autostart registry keys to launch java 48->150 152 Creates multiple autostart registry keys 48->152 104 C:\Users\...\Retrive8806591720793981687.vbs, ASCII 50->104 dropped 106 C:\Users\...\Retrive6383722774547370397.vbs, ASCII 50->106 dropped 58 cmd.exe 50->58         started        60 cmd.exe 50->60         started        62 conhost.exe 50->62         started        64 8 other processes 50->64 file17 signatures18 process19 dnsIp20 114 127.0.0.1 unknown unknown 54->114 88 C:\Users\...\Retrive6848677088724156237.vbs, ASCII 54->88 dropped 90 C:\Users\...\Retrive2956221207444921347.vbs, ASCII 54->90 dropped 66 conhost.exe 58->66         started        68 cscript.exe 58->68         started        70 conhost.exe 60->70         started        72 cscript.exe 60->72         started        74 conhost.exe 62->74         started        76 conhost.exe 64->76         started        file21 process22
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd8e3b2b93b70cc405accd3a69eebeb15f3f9d0e893fba8e95deec8edf0de615/
Threat name:
Archive-JAR.Trojan.AdWind
Create hunting rule
Status:
Malicious
First seen:
2021-09-06 14:50:06 UTC
AV detection:
7 of 42 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xwhdwk4tw4gmibnmzu5gt3v6wfpt7hiore73vduv33wi5xyn4ykq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210906-r7lg9aedej/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/bd8e3b2b93b70cc405accd3a69eebeb15f3f9d0e893fba8e95deec8edf0de615

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Vjw0rm

Java file jar bd8e3b2b93b70cc405accd3a69eebeb15f3f9d0e893fba8e95deec8edf0de615

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/185690/

Comments