Overview

overview

10

Static

static

10

5b44e9b540...26.jar

windows7-x64

10

5b44e9b540...26.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b44e9b540425a8d1a7889bb1749300e0ed46b7ecdd7aff46ddf0d5c4768a126

  • Size

    570KB

  • Sample

    250102-stps7ayrdl

  • MD5

    738115b0931b9515c0fd8211a1ee2308

  • SHA1

    9df1b42b462f1383f74e2ffe31d45be9784e12bb

  • SHA256

    5b44e9b540425a8d1a7889bb1749300e0ed46b7ecdd7aff46ddf0d5c4768a126

  • SHA512

    fc3d34f5a957d5441dbfeefe6c1a2238ab2da827f24169189be13e7bf3abcec5edacaf4c4f1b1932dd55838d6b801c2d1a26b366450649f0e43d37ff127d9c12

  • SSDEEP

    12288:qutFGKBegnvmkqo/Rd6MS3u3Hd/hfg8EObi1QuMT:qWF346exo/RaKHPIZhs

Score
10/10
adwindpersistencetrojan

Malware Config

Targets

    • Target

      5b44e9b540425a8d1a7889bb1749300e0ed46b7ecdd7aff46ddf0d5c4768a126

    • Size

      570KB

    • MD5

      738115b0931b9515c0fd8211a1ee2308

    • SHA1

      9df1b42b462f1383f74e2ffe31d45be9784e12bb

    • SHA256

      5b44e9b540425a8d1a7889bb1749300e0ed46b7ecdd7aff46ddf0d5c4768a126

    • SHA512

      fc3d34f5a957d5441dbfeefe6c1a2238ab2da827f24169189be13e7bf3abcec5edacaf4c4f1b1932dd55838d6b801c2d1a26b366450649f0e43d37ff127d9c12

    • SSDEEP

      12288:qutFGKBegnvmkqo/Rd6MS3u3Hd/hfg8EObi1QuMT:qWF346exo/RaKHPIZhs

    Score
    10/10
    adwindpersistencetrojan

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • Adwind family

      adwind

    • JAR file contains resources related to AdWind

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks