Overview

overview

10

Static

static

1

681105abdc...f0.jar

windows7-x64

10

681105abdc...f0.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    681105abdc5d0c0343775b60daf355f0

  • Size

    628KB

  • Sample

    240119-tnqzqsaaf6

  • MD5

    681105abdc5d0c0343775b60daf355f0

  • SHA1

    19df3c8b66be211e6cb1cc01cf7c7eff5064fc8b

  • SHA256

    9de696d1d6fb1228d3697b7be4e628d6489c4bc2dcfacc54b1fb282fe4fbebe9

  • SHA512

    649fe254c397cace915c1348da5e8a6f35621a9a29ce720261e824fb91efe4d5b6276edb54ecdf9e606f2046c68b0ef5c5a1ed1a405585591f5856c9fe32893b

  • SSDEEP

    12288:p9JFYoYph7hbhUItEv1GUSSoPwokLOqf5SEmkkjB0bCSoZiZ3znQBu:p97YoYt7oSjYOKSEUBwoZiZ3zQY

Score
10/10
adwindvjw0rmdiscoverypersistencetrojanworm

Malware Config

Targets

    • Target

      681105abdc5d0c0343775b60daf355f0

    • Size

      628KB

    • MD5

      681105abdc5d0c0343775b60daf355f0

    • SHA1

      19df3c8b66be211e6cb1cc01cf7c7eff5064fc8b

    • SHA256

      9de696d1d6fb1228d3697b7be4e628d6489c4bc2dcfacc54b1fb282fe4fbebe9

    • SHA512

      649fe254c397cace915c1348da5e8a6f35621a9a29ce720261e824fb91efe4d5b6276edb54ecdf9e606f2046c68b0ef5c5a1ed1a405585591f5856c9fe32893b

    • SSDEEP

      12288:p9JFYoYph7hbhUItEv1GUSSoPwokLOqf5SEmkkjB0bCSoZiZ3znQBu:p97YoYt7oSjYOKSEUBwoZiZ3zQY

    Score
    10/10
    vjw0rmpersistencetrojanwormadwinddiscovery

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks