Overview

overview

10

Static

static

3

Sorillus V...ed.zip

windows10-2004-x64

10

Resubmissions

15-12-2024 09:11

241215-k53v7a1per 10

15-12-2024 09:04

241215-k1sjna1nek 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Sorillus V6.2 updated.zip

  • Size

    224.0MB

  • Sample

    241215-k1sjna1nek

  • MD5

    93c78d45339f83c36c9da8e79d3f1665

  • SHA1

    507de0bdffff3a316e0156fa14e514bf788da446

  • SHA256

    862d9420d4773e4bf8f106e01398a351ff6837a2d02457b48120cd0bb631f162

  • SHA512

    277fca01af54a970f043c1aeb7b10fd0c79aed776b14ac9a706b683372d9adf158cc45cdf1a5d3dfa8faaf5357dcf239e197db2564af460734414d39dbd2318f

  • SSDEEP

    786432:KB7pso5UjVIrcv6c1BsaWWrXzdYCrYVcbGR53UMrwBSlomS5nr5v6sIcI47Tj+2M:KdAacvHBsaT3dp2x3UdiTx/Irg0cwfO/

Score
10/10
adwinddiscoverypersistencetrojan

Malware Config

Targets

    • Target

      Sorillus V6.2 updated.zip

    • Size

      224.0MB

    • MD5

      93c78d45339f83c36c9da8e79d3f1665

    • SHA1

      507de0bdffff3a316e0156fa14e514bf788da446

    • SHA256

      862d9420d4773e4bf8f106e01398a351ff6837a2d02457b48120cd0bb631f162

    • SHA512

      277fca01af54a970f043c1aeb7b10fd0c79aed776b14ac9a706b683372d9adf158cc45cdf1a5d3dfa8faaf5357dcf239e197db2564af460734414d39dbd2318f

    • SSDEEP

      786432:KB7pso5UjVIrcv6c1BsaWWrXzdYCrYVcbGR53UMrwBSlomS5nr5v6sIcI47Tj+2M:KdAacvHBsaT3dp2x3UdiTx/Irg0cwfO/

    Score
    10/10
    adwinddiscoverypersistencetrojan

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • Adwind family

      adwind

    • Class file contains resources related to AdWind

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks