Overview

overview

10

Static

static

3

Zelo-Client.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Zelo-Client.exe

  • Size

    647KB

  • Sample

    241020-23pn8avhmf

  • MD5

    6a8c1f741fa6b769273261f408a4dc31

  • SHA1

    fb9c298f981965d2af6b0616a87f3c2c03596311

  • SHA256

    32bcbaad1e453a6a32bcbb90178b7b75168c43287e51954962ed2e2c565133a1

  • SHA512

    306c7447e4e8cc7b6fa5830bfb1ef1a58dfd523fb89dc739e68bd453c6f8163631d35b5accd1717dcd18d7bc1187d69f5b67bf357325ba48c44c11db26f9bfb5

  • SSDEEP

    12288:Rwhg3NJmAtot9EJy80QYw2U1u6/RdQ7Zzf9STRu0FdShOcymSesf:Ohg5obEc80QR2UbJM9STFfLcymS

Score
10/10
adwinddefense_evasiondiscoverypersistencetrojan

Malware Config

Targets

    • Target

      Zelo-Client.exe

    • Size

      647KB

    • MD5

      6a8c1f741fa6b769273261f408a4dc31

    • SHA1

      fb9c298f981965d2af6b0616a87f3c2c03596311

    • SHA256

      32bcbaad1e453a6a32bcbb90178b7b75168c43287e51954962ed2e2c565133a1

    • SHA512

      306c7447e4e8cc7b6fa5830bfb1ef1a58dfd523fb89dc739e68bd453c6f8163631d35b5accd1717dcd18d7bc1187d69f5b67bf357325ba48c44c11db26f9bfb5

    • SSDEEP

      12288:Rwhg3NJmAtot9EJy80QYw2U1u6/RdQ7Zzf9STRu0FdShOcymSesf:Ohg5obEc80QR2UbJM9STFfLcymS

    Score
    10/10
    adwinddefense_evasiondiscoverypersistencetrojan

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • Class file contains resources related to AdWind

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks