Overview

overview

10

Static

static

3

Z_y_x.exe

windows7-x64

10

Z_y_x.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Z_y_x.exe

  • Size

    1.2MB

  • Sample

    241020-1rd8nstfnl

  • MD5

    1ba7ea14b1d32748dc172194491e8dd4

  • SHA1

    05b82857e8e98562edb9481fb1e8b889866cae16

  • SHA256

    7e15567c88d2ff2677f19fcb64c3814851f8433e819f57f550c1c82bc787468c

  • SHA512

    42e431820c118611090c7456dc8a52029c4f13ae9ccb278f7a31d43f940ae027381c95753f4e2184f07c0f9c86f14110a8590ad8646c3d8a733115fb9e26140a

  • SSDEEP

    24576:4pd9K7MlGXwz+AV8G2OpvcwLkpd9K7MlGXwz+AV8G2OpvcwL:IqolGXwz+I8ERLUqolGXwz+I8ERL

Score
10/10
adwindpersistencetrojan

Malware Config

Targets

    • Target

      Z_y_x.exe

    • Size

      1.2MB

    • MD5

      1ba7ea14b1d32748dc172194491e8dd4

    • SHA1

      05b82857e8e98562edb9481fb1e8b889866cae16

    • SHA256

      7e15567c88d2ff2677f19fcb64c3814851f8433e819f57f550c1c82bc787468c

    • SHA512

      42e431820c118611090c7456dc8a52029c4f13ae9ccb278f7a31d43f940ae027381c95753f4e2184f07c0f9c86f14110a8590ad8646c3d8a733115fb9e26140a

    • SSDEEP

      24576:4pd9K7MlGXwz+AV8G2OpvcwLkpd9K7MlGXwz+AV8G2OpvcwL:IqolGXwz+I8ERLUqolGXwz+I8ERL

    Score
    10/10
    adwindtrojanpersistence

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • Class file contains resources related to AdWind

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks