adwind

General

Target

Zelo-Client.zip
Size

1.0MB
Sample

241021-cbazbavbrp
MD5

7cc928c5977cbe6647a96c579848549a
SHA1

3df079656a2475b9e42e54f105fe906ad4674e31
SHA256

54a315390611e4ad38c06bdc331215786acf272a2bcace2f0b9464f504c23d50
SHA512

f7c54f74e4db65d9ae0124c1cf3a429382081b748afd3a5b6e9a21c5886637382be56b82ee3e43d65e3b2e8de908cd2ed16ad458ea2e186110a72819b0b6506b
SSDEEP

24576:ISi50EhR1E4ExAhfn21Od2IYezmeMXRUCQRxyc6:IXJR1E4rdncYMBUHOb

Score

10^/10

Malware Config

Targets

- Target
  
  Zelo-Client/Auto updater.dll
- Size
  
  705KB
- MD5
  
  0264728f7c770c716480ccbb1d8a7f49
- SHA1
  
  90c177cf8f061fa9f28f81f615c871062d170d5e
- SHA256
  
  92ada1d4e57dc2d82531e066160cf5f547c95839a3deebb89e9c504a2c2e067d
- SHA512
  
  89194dede10d538261dbf724f189ae74f9fa3ec32fa4f1eb1e7a7342e94f9ceec78ced463f65e99cd0ab6bf5dd79a5d8524841c02987e20f384f852d140df44d
- SSDEEP
  
  12288:cH9IlWdA6cMcv8CmQknniiGm9+OlvS0Sj6v0R2n:cH9tdA6cMi8CmpnnT3lvfc
Score

1^/10
behavioral1 behavioral2
- Target
  
  Zelo-Client/Zelo-Client.exe
- Size
  
  647KB
- MD5
  
  6a8c1f741fa6b769273261f408a4dc31
- SHA1
  
  fb9c298f981965d2af6b0616a87f3c2c03596311
- SHA256
  
  32bcbaad1e453a6a32bcbb90178b7b75168c43287e51954962ed2e2c565133a1
- SHA512
  
  306c7447e4e8cc7b6fa5830bfb1ef1a58dfd523fb89dc739e68bd453c6f8163631d35b5accd1717dcd18d7bc1187d69f5b67bf357325ba48c44c11db26f9bfb5
- SSDEEP
  
  12288:Rwhg3NJmAtot9EJy80QYw2U1u6/RdQ7Zzf9STRu0FdShOcymSesf:Ohg5obEc80QR2UbJM9STFfLcymS
Score

10^/10

adwind defense_evasion trojan persistence
- AdWind
  A Java-based RAT family operated as malware-as-a-service.
  trojan adwind
- Class file contains resources related to AdWind
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral3 behavioral4