adwind

General

Target

6abe27f5fb28b360152fb6dc7f521d64_JaffaCakes118
Size

4.3MB
Sample

240523-m88lysea4v
MD5

6abe27f5fb28b360152fb6dc7f521d64
SHA1

c29253502e7799a4468c569ea907cfa4d2852b62
SHA256

4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0
SHA512

7b505b00b38b6dc088a771946f1a1f4b4d732503ba45b4c085e0f84a179ceb3225019480b51289d37bc4612b01e317167660bf5ca5f139edae45a0f215e75b32
SSDEEP

49152:IF0Mm2cTlxddiX12EOC3OTe44A8xXiHFjCuf0J1d7H8BummLm/fj8/zkGT/dZ91F:IFBmc

Score

10^/10

Malware Config

Extracted

Family

xtremerat

C2

mongtrelgo.hopto.org

Extracted

Family

lokibot

C2

http://hydeoutent.com/app/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  6abe27f5fb28b360152fb6dc7f521d64_JaffaCakes118
- Size
  
  4.3MB
- MD5
  
  6abe27f5fb28b360152fb6dc7f521d64
- SHA1
  
  c29253502e7799a4468c569ea907cfa4d2852b62
- SHA256
  
  4331fd03d4281b82c3be8dcee3d53559ecb824e1bfdf4d86475c795ac209f0d0
- SHA512
  
  7b505b00b38b6dc088a771946f1a1f4b4d732503ba45b4c085e0f84a179ceb3225019480b51289d37bc4612b01e317167660bf5ca5f139edae45a0f215e75b32
- SSDEEP
  
  49152:IF0Mm2cTlxddiX12EOC3OTe44A8xXiHFjCuf0J1d7H8BummLm/fj8/zkGT/dZ91F:IFBmc
Score

10^/10

adwind lokibot xtremerat collection persistence rat spyware stealer trojan upx discovery evasion
- AdWind
  A Java-based RAT family operated as malware-as-a-service.
  trojan adwind
- Class file contains resources related to AdWind
- Detect XtremeRAT payload
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- UAC bypass
  evasion trojan
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Disables Task Manager via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2