adwind | 5d3f4bf53d17846ad8743e6766e6b087f407e98bd98b9a60503ca2894636787a

Resubmissions

01/09/2024, 17:02

240901-vj78wswfnl10

01/09/2024, 17:01

240901-vjvmssxcjb10

01/09/2024, 17:01

240901-vjh9rswflp10

01/09/2024, 17:00

240901-vjcf8awflm10

Sharing

Copy URL Twitter E-mail

General

Target
Probiv-Api-Glaz-Boga.jar
Size 4.1MB
Sample240901-vj78wswfnl
SHA256 5d3f4bf53d17846ad8743e6766e6b087f407e98bd98b9a60503ca2894636787a
MD5 f20e6c029978da0fb19737397dbaae76
SHA1 12b9fd28c7bd4d0093b8c96648c8c063edd94b49
SHA512 422a08ec06f826a3915857af173fc1e3e43a17c30f2c84dee534251f8c0069f3d2d0bdd99b7cc11e1b3d12318fd1c0b9ae04dc252b43468eafd44ce03825afe4
SSDEEP 98304:T/+j4IAoFUlrEvqIxzpgyHOF2SfVShgWmdB7mdmGA2:L+j5AoeAxdlO2q9WY7B2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Probiv-Api-Glaz-Boga.jar
- Size 4.1MB
- SHA256 5d3f4bf53d17846ad8743e6766e6b087f407e98bd98b9a60503ca2894636787a
- MD5 f20e6c029978da0fb19737397dbaae76
- SHA1 12b9fd28c7bd4d0093b8c96648c8c063edd94b49
- SHA512 422a08ec06f826a3915857af173fc1e3e43a17c30f2c84dee534251f8c0069f3d2d0bdd99b7cc11e1b3d12318fd1c0b9ae04dc252b43468eafd44ce03825afe4
- SSDEEP 98304:T/+j4IAoFUlrEvqIxzpgyHOF2SfVShgWmdB7mdmGA2:L+j5AoeAxdlO2q9WY7B2
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

evasion execution
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral10 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10