adwind

General

Target

7d6a08f1c4b78083a5c14b1f152cfa77_JaffaCakes118
Size

1.8MB
Sample

240528-slmc4ahh91
MD5

7d6a08f1c4b78083a5c14b1f152cfa77
SHA1

8b8a045dab5ab2fe8c0957bb3635b7e613c3615a
SHA256

22dc5c40df7e2e24da3b265555684c68072ff80862339d37751e203b6c2d8969
SHA512

20a5cbc4daa885888cf2e93be04d031b27168d1da9ec501d2550bbfa979870faea9152b1c5c1e34371fd21fcd028c4f608483e03b1ce202cffd909979a88d21d
SSDEEP

49152:08pWi3yXnPdRL0SuUYvxnrMnvDkP1DCkbtADtrZKZwy:bAnNuUYvxnwQ92icr8x

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://krungonline.com/wp-admin/css/Panel/gate.php

Targets

- Target
  
  7d6a08f1c4b78083a5c14b1f152cfa77_JaffaCakes118
- Size
  
  1.8MB
- MD5
  
  7d6a08f1c4b78083a5c14b1f152cfa77
- SHA1
  
  8b8a045dab5ab2fe8c0957bb3635b7e613c3615a
- SHA256
  
  22dc5c40df7e2e24da3b265555684c68072ff80862339d37751e203b6c2d8969
- SHA512
  
  20a5cbc4daa885888cf2e93be04d031b27168d1da9ec501d2550bbfa979870faea9152b1c5c1e34371fd21fcd028c4f608483e03b1ce202cffd909979a88d21d
- SSDEEP
  
  49152:08pWi3yXnPdRL0SuUYvxnrMnvDkP1DCkbtADtrZKZwy:bAnNuUYvxnwQ92icr8x
Score

10^/10

adwind nanocore pony collection discovery evasion keylogger persistence rat spyware stealer trojan upx
- AdWind
  A Java-based RAT family operated as malware-as-a-service.
  trojan adwind
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Suspicious use of NtCreateProcessExOtherParentProcess
- UAC bypass
  evasion trojan
- Disables Task Manager via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2