🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eecc7cc02e9891623f9a1e1b5367b4f818177ebc80461f6bf528d77faf46b521. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adwind


Vendor detections: 6


Intelligence 6 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eecc7cc02e9891623f9a1e1b5367b4f818177ebc80461f6bf528d77faf46b521
SHA3-384 hash: 7b25553051300d989513fc12edb4213b07cdffa66429193085d79e5c0748d0862c8aed097ef2a51101fcabaa8ff56852
SHA1 hash: c6fd2821b02778bfa69d2d62f6fdae2fd9592da3
MD5 hash: 68a0ec597a11e483998d6a374bbf04b6
humanhash: tennessee-table-magazine-arizona
File name:SKM567432788.jar
Download: download sample
Signature Adwind
Create hunting rule
File size:653'418 bytes
First seen:2022-08-30 08:06:14 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 12288:ATzYub6hdsd/tNfrwPLo9v8Tne5c0TX3Td/NLwRcqZGQ6HgraxYLW7c6eOhSetj+:QpuhdefrwGv8Tb03d/hwRKACn7cvOwek
TLSH T116D423CB06AAC6F7CC2731F5E54233A155986CCEBB1C9432FF42F9A4188E70995A0D6D
TrID 72.9% (.JAR) Java Archive (13500/1/2)
21.6% (.ZIP) ZIP compressed archive (4000/1)
5.4% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter abuse_ch
Tags:Adwind jar


Avatar
abuse_ch
Adwind C2:
84.38.129.32:33160

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
84.38.129.32:33160 https://threatfox.abuse.ch/ioc/846271/

Intelligence

File Origin
# of uploads :
1
# of downloads :
238
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SKM567432788.jar
Verdict:
No threats detected
Analysis date:
2022-08-30 08:07:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0e24a7ae-d934-4d00-97a6-557f69b89807

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/302426/
Detection(s):
SecuriteInfo.com.Java.Muldrop.37.16690.14910.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/630dc5a059c0157606ba0675/reports/fda2bd34-b90f-47f2-a3e4-dc9cf1376d5a/overview
Result
Threat name:
ADWIND, PrivateLoader
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1060323
Signature
Antivirus detection for dropped file
Detected ADWIND Rat
Exploit detected, runtime environment starts unknown processes
Java source code contains strings found in CrossRAT
Malicious sample detected (through community Yara rule)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Yara detected AdWind RAT
Yara detected AdWind RATs dll
Yara detected PrivateLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 692840 Sample: SKM567432788.jar Startdate: 30/08/2022 Architecture: WINDOWS Score: 100 85 1zvblok.duckdns.org 2->85 87 Malicious sample detected (through community Yara rule) 2->87 89 Antivirus detection for dropped file 2->89 91 Detected ADWIND Rat 2->91 93 7 other signatures 2->93 12 cmd.exe 2 2->12         started        signatures3 process4 process5 14 java.exe 6 12->14         started        16 conhost.exe 12->16         started        process6 18 wscript.exe 3 3 14->18         started        20 icacls.exe 1 14->20         started        process7 22 javaw.exe 13 18->22         started        25 wscript.exe 18->25         started        27 conhost.exe 20->27         started        file8 67 C:\Users\...\Retrive7037630496652242903.vbs, ASCII 22->67 dropped 69 C:\Users\...\Retrive5712554490458854822.vbs, ASCII 22->69 dropped 29 xcopy.exe 22->29         started        32 java.exe 13 22->32         started        35 cmd.exe 1 22->35         started        37 cmd.exe 22->37         started        process9 dnsIp10 71 C:\Users\user\AppData\Roaming\...\zip.dll, PE32 29->71 dropped 73 C:\Users\user\AppData\...\wsdetect.dll, PE32 29->73 dropped 75 C:\Users\user\AppData\...\w2k_lsa_auth.dll, PE32 29->75 dropped 81 128 other files (none is malicious) 29->81 dropped 39 conhost.exe 29->39         started        83 192.168.2.1 unknown unknown 32->83 77 C:\Users\...\Retrive7776069345535476873.vbs, ASCII 32->77 dropped 79 C:\Users\...\Retrive2091281393067888640.vbs, ASCII 32->79 dropped 41 cmd.exe 1 32->41         started        43 cmd.exe 32->43         started        45 xcopy.exe 32->45         started        47 conhost.exe 32->47         started        49 cscript.exe 1 35->49         started        51 conhost.exe 35->51         started        53 conhost.exe 37->53         started        55 cscript.exe 37->55         started        file11 process12 process13 57 cscript.exe 1 41->57         started        59 conhost.exe 41->59         started        61 conhost.exe 43->61         started        63 cscript.exe 43->63         started        65 conhost.exe 45->65         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eecc7cc02e9891623f9a1e1b5367b4f818177ebc80461f6bf528d77faf46b521/
Threat name:
ByteCode-JAVA.Trojan.AdWind
Create hunting rule
Status:
Malicious
First seen:
2022-08-30 08:07:07 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
13 of 26 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=53ghzqbotciwep42dynvgz5u7ambo7v4qbdb627vfdlx7l2gwuqq._file
Result
Malware family:
adwind
Create hunting rule
Score:
  10/10
Tags:
family:adwind evasion persistence trojan
Link:
https://tria.ge/reports/220830-jzzqxaeahr/
Behaviour
Kills process with taskkill
Modifies registry class
Modifies registry key
Runs .reg file with regedit
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Drops file in System32 directory
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Disables Task Manager via registry modification
Disables use of System Restore points
Executes dropped EXE
Sets file execution options in registry
AdWind
UAC bypass
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/eecc7cc02e9891623f9a1e1b5367b4f818177ebc80461f6bf528d77faf46b521

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/302426/

Comments