Overview

overview

10

Static

static

3

sorrilus.exe

windows7-x64

10

sorrilus.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jre1.8.0_361.zip
  • Size 89.4MB
  • Sample231202-e49z8ahg91
  • SHA256 ce236d04aae0118265f73e1775a0ce05aa6357e0922905b2d08540f100c37ee5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwinddiscoverytrojan

Malware Config

Targets

    • Target
      sorrilus.exe
    • Size 10.3MB
    • SHA256 314278fc36d4bf2c2051c64b5dd274c6254e51c8db45bb5174750839f63bab53
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    adwindtrojandiscovery

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • Class file contains resources related to AdWind

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies file permissions

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks