Overview

overview

10

Static

static

10

4b2d4d21b5...19.jar

windows7-x64

10

Resubmissions

17/01/2025, 17:52

250117-wfrx6sypgl 10

17/01/2025, 17:44

250117-wa5xvayjcv 10

22/09/2024, 11:10

240922-m9p61awgjr 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019

  • Size

    570KB

  • Sample

    250117-wfrx6sypgl

  • MD5

    31f90d8a8a473074bfeef7972d5a39b2

  • SHA1

    083a3c0e8c33f1ea8d0f59f76e8e82a6871aebdd

  • SHA256

    4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019

  • SHA512

    bc8abbfba825303e38ed4a29d72af2a1f6d54592a14e53807defb0d24326ab540645e7b69f4fe5b79e9e3bb4dc10e5fda0281e852443700feea512db7654dc68

  • SSDEEP

    12288:JME6KYOW/U7JA1T7hyiGuwtjXOi8KyI/qroUIRMZNmkq0pT8Kiy4:3YOAU1A1pULOi8Ky4qrohMZNuET8D

Score
10/10
adwindevasionpersistencetrojan

Malware Config

Targets

    • Target

      4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019

    • Size

      570KB

    • MD5

      31f90d8a8a473074bfeef7972d5a39b2

    • SHA1

      083a3c0e8c33f1ea8d0f59f76e8e82a6871aebdd

    • SHA256

      4b2d4d21b5df75339eb821f2e50855c273fdd0ef36f258bf7cd879cb47e5f019

    • SHA512

      bc8abbfba825303e38ed4a29d72af2a1f6d54592a14e53807defb0d24326ab540645e7b69f4fe5b79e9e3bb4dc10e5fda0281e852443700feea512db7654dc68

    • SSDEEP

      12288:JME6KYOW/U7JA1T7hyiGuwtjXOi8KyI/qroUIRMZNmkq0pT8Kiy4:3YOAU1A1pULOi8Ky4qrohMZNuET8D

    Score
    10/10
    adwindevasionpersistencetrojan

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • Adwind family

      adwind

    • JAR file contains resources related to AdWind

    • UAC bypass

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Tasks