adwind | eb39e3c3215ee01a3ed0148766b22b139d1cf42a3631b7c99144ae2d181bbb8c

Sharing

General

Target
ca0a2bd0633e8462f759a607a5f38ed8_JaffaCakes118
Size 13.2MB
Sample240830-ck7dwascka
SHA256 eb39e3c3215ee01a3ed0148766b22b139d1cf42a3631b7c99144ae2d181bbb8c
MD5 ca0a2bd0633e8462f759a607a5f38ed8
SHA1 82d49e5b5dfc7620091ca939fe02cb389ffda78d
SHA512 9715e45578bf743641c9179b5efa83bad756315f848ff1a99e08288565f7e8620b74192b0392a61dcf9672e66e87a86d8fbf5b9f12dd45abd6aefdef09becb99
SSDEEP 393216:GoFNAmr9UhNiKmsu1cpYBhd3LBEAZXjgfvDbibYpSr:GonH994u0k7SG8CM0r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

127.0.0.1:5552

Mutex

279f6960ed84a752570aca7fb2dc1552

Attributes

reg_key
279f6960ed84a752570aca7fb2dc1552
splitter
|'|'|

Targets

- Target
  2017.6.30/001.vir
- Size 25KB
- SHA256 e0b11991a067f9403b27a3ee1ccb4c86fb07923a56fe4a3d482f99d8c72398b7
- MD5 4e5968ce2a7db6a394ffd298d64c628f
- SHA1 2bf81b304599b114ff1323e0579480af7c5d2239
- SHA512 b24a502ee4a5e1f8242496ce3cecfe466c0334068bb2da589f88085856752f26ba720add164706ac7a1f4c0eaed84e1468443cf0f6bd57151fd2d79c2077f12c
- SSDEEP 384:y/xiT2YNJPH1R2L3/9mkjicnYbS1trQClPIg1skB10ZcTS4TVhGIndaj:y/x0NJPH1ROlmsYm1trQCCS68Vpi
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  2017.6.30/002.vir
- Size 353KB
- SHA256 4df4f5d5f17856c8a429fd454ec7c3fb06cfd153a52cec0110c89995661905fc
- MD5 698f9010c068c41bb1fbcdc4b6d3f1f4
- SHA1 37ff2d707ff8e16ed3522ff4afab22d8128ea15e
- SHA512 bf8073dd5ad29fe611d75b0a4c2269d7d2d8508e11ea8cfad9f7e8c3f31cfa627784edb178b32cd54a34f543c30cab46b0668a60b3dbeba64503606ec6b2b695
- SSDEEP 6144:y/Bt80VmNTBo/x95ZjAetGDN3VFNq7pC+9OqFoK30b3ni5rdQY/CdUOs5:y/X4NTS/x9jNG+w+9OqFoK323qdQYKUJ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

mimikatz bootkit discovery persistence spyware stealer
- Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- mimikatz is an open source tool to dump credentials on Windows
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral3 behavioral4
- Target
  2017.6.30/003.vir
- Size 635KB
- SHA256 f259d1b9aab8e7afe82e316e140112de4d706c721a53581326ddd108896a4094
- MD5 4fb20fb692d86b447844054745d373c3
- SHA1 075de51a1abc4da355d4ea88c6b32d3082608f2d
- SHA512 2f82efba12b356fc3c4e2ef7323bd4e9aba81386bec4580625ab53a934eb53cf77a087239032f889a203555b1720bbeab7d297bcc81155d45682224181d7a60d
- SSDEEP 3072:AGhyhsLS0kFMSnTbhJk7hxGP9SRSSp4OR5bFP73NiVMC:AGhyh8SnTIhQO95xPkVMC
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  2017.6.30/004.vir
- Size 96KB
- SHA256 e714f5cf5f431dfe42e81572accbd625caf93a6fe33fbcc9d939a4470a55c038
- MD5 ee1e4778977285657044bd6ab10b8a69
- SHA1 1816a47d36184139930e735a6a0ba36d4841079f
- SHA512 4d4214522b3504f1e82e4f675ccc5f0777e8bac2e7cafe0607ad36a5abbbff725f4aaebbc3807e4eaea806ddefe65542fb746ea5021bfc7ce1be8513eaf11231
- SSDEEP 1536:bVkZShQ7BWNxTLmCjwcqaz6/A3gA1xZNvlwo:bISC7kzLmCscqZopZNvuo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  2017.6.30/005.vir
- Size 5KB
- SHA256 c777cb3b2afee7c81409c97e8b320d172657d382a2295a7c17ca43e79696f44d
- MD5 1152ccbc0eb00b95cc58464267ddaf42
- SHA1 f032e331889d47afa83f8674a913a94124b1d57e
- SHA512 f88482d76196668453770bef800e6eec7b3ecbe6a73563c8913bc4d81ad5edd2d1c106b5d60427c24ddb9ab663441aea7b49d12c6a0d526b79551aabfb07103a
- SSDEEP 96:3NSyA2KBaF28yBdwmR8wdiIIkyuzklch+lCzrL4mitKJO9iUq+EJ5hvgGzrYKGfq:CBaF2Bg45Y/6qCzlJMil3bzr2N2Yhf4Z
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  2017.6.30/006.vir
- Size 37KB
- SHA256 a292b9f97542f2a7ff6686dddb2948b4ec028c878c78f3871570783d3191bd95
- MD5 45b2bd1aa8f2b26f8454fccca96c9dea
- SHA1 807f89ae5ac02dcb2bfe74986b9135da229bf731
- SHA512 a341b100fa16b1da908f1fa7b3038744f75329ed573d363eeddcbc13722bd0dd48d635ea415694c8956ae9a5055db8b585d8b34200365a8fabb58a221bd1e081
- SSDEEP 384:hIlheBSz0YDfV9fPsiS2NgMwxV2/lqat//FEd0j2MA2pOF:qeBkjVxNuxU/lv0xepOF
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  2017.6.30/007.vir
- Size 11KB
- SHA256 2a9bb5fbc454afdb77a806f49adb5373025a53891c67d72a7f098751fc78d54c
- MD5 c15070793d6b3c25b385508fedaf2b7c
- SHA1 e7387dcb9b2f745ad29405043438e8ee45781e2b
- SHA512 1f0732a362cc118026b866de3d706e6544aed741f53b461e622e90d552d7508092ee8bdbd83b5b667d4f01d339b7e3ba5058c5231170c28b9cd718b4fba702dd
- SSDEEP 192:bLh/1Tm1qJZoRXWoiDMYgVPcCiSQZbdrdrjJbEm89QJg/m1G6VMaZiAzE:ZN61qJCRXnibQ0CiSQ5rdrjWwJQ6uaE3
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10
- Blocklisted process makes network request
behavioral13 behavioral14
- Target
  2017.6.30/008.vir
- Size 551KB
- SHA256 7dfd7ca9e92fc55553fad3a31ce2112536f337c08b4e5e9384539d00c133f52e
- MD5 cff2381d0db1bc2f7d1968e31f4524cd
- SHA1 7b21ce6335505fcd11a4f20a4e9aebbdc9c8110c
- SHA512 2669c7e95158e9e828db2f8a4af1cf7c3cb497a220d9e24fc0ec41e6e475da304c172b358dd15f7aa8c2a9f000d77d453af209dda6bcd3671cc1e6f86332b5f7
- SSDEEP 12288:x2B+k6oRVbZgXRcRsalB/dgS7bMzKqcJ0tFvKAQn9/Lcqifq3zcm28qCr6V:x2rVCXqV/dV7byKWtF+vf56
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  2017.6.30/009.vir
- Size 5KB
- SHA256 d0e49f28d87ae149e9e97c1b369981a34ede46467205d68eccba47f37cde81be
- MD5 d2739f2a76fae7235fd2c9840f553894
- SHA1 abca1430327de940e899fad303c79990faea1847
- SHA512 c254a23b00205480f8871e634e0f55fbacdae809193fb544f140ef31ad3b9298cb3f8ac26ef7c950046aecfb280876f8a476afa0faedcd6f3b510e0a70445760
- SSDEEP 96:jSQGE4BEVG8i/Xa9XIakiIIky5jklTk+lCzrL+mitMJOF8+pihbQVezrWt1+4MYE:kBEVGPKIzYiRCzDJO80YZzrWXMYBveiO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  2017.6.30/010.vir
- Size 90KB
- SHA256 33a78ab6f768362e468321871570ae195028cf2fb877ac196bdc2d94a381bb2f
- MD5 3ef0f8433dedf3cdc25f8fa8b2471673
- SHA1 31c1adc34e51d737a07cc1f79b9fa64337c2afd9
- SHA512 51b9d7f2d0424d9bf1bd2ee98a71cbde84a7463ca825912e7f0f653bcfdb87c8fbbc39657189ee8d347c94741d481e7b2b4c90989353f3c9c1cd48c453bed9fe
- SSDEEP 1536:Fibs/7znzNP1c0t6FAT7ho1csd/qQ0rd+jjU0WZmn:Fl7znzT8mTlo1c8/B0h+jjKZC
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  2017.6.30/011.vir
- Size 109KB
- SHA256 bed6d4edea72adf31a00dd6009819fb78516552cd0ffaf6f3fd3fc27c7cc7a72
- MD5 839cd21afaaa5013348de59ed6a7078a
- SHA1 e20d8f8ffe2ba26d8aeb52dae046444f7d502341
- SHA512 adc08c6e28ca8e8653c6d5a7592f96d556e729ff4c1e42e0c57511ea046d47f352e3fcf37ff247f4d024ecd5bc7883f10c655ab148fce88c0eea651a9439cc47
- SSDEEP 3072:jlZfoH5NmxBbRXqIUcIN4Is+i0tXyDS4cb:hzBbRXzUcoXxC24cb
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  2017.6.30/012.vir
- Size 280KB
- SHA256 2d051ae4aef03805c77bc5de3ae425ca66440cecda0826f5fcd6fac55c18adf3
- MD5 76bc6a5abe9b68a208d1837c29cb1d5b
- SHA1 65d0084a88f9cd5df41e8e943a14ad30ad14391e
- SHA512 735d657dfc38f1f325f03375144e0a0425b2bd7fbe98688d37449891b27dd3aa52f5303d28363cad98a58f8441780a32b4ab767a9e1426bbc71ec8ee2f44482e
- SSDEEP 3072:tou9YlI6eHSxu05uIf+fDM5iIY4c8OT2ihkJooAO+vLAOlya/7NbC4Ugah66:t9E3B/2ae4c8OqIecOSEOlyaDJY
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  2017.6.30/013.vir
- Size 12KB
- SHA256 674f00e2033ebaf0623a4b6425be8a19d2cbd0a93e0d9a5d0e6d015b1c0f01eb
- MD5 3315df622f775f8028c281e409c1cc3f
- SHA1 a87af661190ec765b7c2a5451b43c1236b8cfa93
- SHA512 fad0327c71baa4a820230f11ad87d5468cabb37644dc31f64a3a399e36a5111f49da6c61577e0fe14eb51961ddb1b39245ee6811f80c8364376540135c019abd
- SSDEEP 192:e/kxEcepRqIjzb2UyIGCrMN8A+rai4vDZ4Ty7UVmka1Sk3pe:esCcARlzbXjGCpA+WDZ4u7UVs1SI8
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral25 behavioral26
- Target
  2017.6.30/014.vir
- Size 67KB
- SHA256 228c33b83ada501826957ba46b635a9952b96a448051869744670f4fd20c3ca0
- MD5 8fcf50599bd54a53414c3780df5ef113
- SHA1 9ea0e052eaaece4f7864dbe70827858a048b1608
- SHA512 1b2be79c21bc3feec39db1d0360d998595c007f4fa264a6104b327890960cb0671889bb19b4f01c8d278f1bc34551fccfd0cd42831cf4ff518a3d59a5caa4d1b
- SSDEEP 1536:YoH5ozfxiefWh5NM1tyMf2wYAQ8A1WS9k9:dH5MiefG5NLMewYX1Xs
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  2017.6.30/015.vir
- Size 256KB
- SHA256 8d33ac763c14d6bedcb383bff103464fd80779726d275d6f8c0f59c2462c5fc9
- MD5 a064605e42293391f79a4eb0f0858d66
- SHA1 a0b943070566f1b38e7d0eefe0ae096df936a7ac
- SHA512 539d07c21d92198c61314f784852841fd2f4e01e4a500a6424f4679d1ec0274f3257f1e18dea157fb1ae08e54898b9bf2d06525ded8dde13188c2cb0799e9e95
- SSDEEP 3072:e/7519/F3xyBPn6U4BNK9vk0+UEW+i17XKLJR3qK+Op440SXxY129e:e/p/FhgJg9PQRY9qE4h2Y1p
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ramnit banker discovery evasion persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Drops startup file
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral29 behavioral30
- Target
  2017.6.30/016.vir
- Size 42KB
- SHA256 f3c4c2bc1dbfaff708160dd5cc0fde322e09ffbbbb251a7a281ce550853e2406
- MD5 41d7cb8ed4cf0e8e7f7dad55f61f1f92
- SHA1 227aa7b8f44cfe653b089562c2e8f454ec532b0e
- SHA512 caa29dbf300d2dc872e016d5e7b5f93833b7c1e4313f92fcdb3115fe84d7efd11468aea826b0e01e009b1482f312c7a6fb9d6d34bbcfbeb9615aecd316cb7f74
- SSDEEP 768:yND7uJvbqi1suCpCxuKFS5yJYgHU71QtWSADh6k7UB3+J4KCPR+NGAln:cu9O8NvFPYCm1QMNjK3+JDCR0hn
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral31 behavioral32