Extracted

Extracted

Extracted

• • Target

    yWorAvKu.exe

  • Size

    1.0MB

  • MD5

    acf7ad3cd2ff2f71d7aeaf8a78ee641e

  • SHA1

    2c2dd1a2a5b9703737db85c2f5374955f0af5f06

  • SHA256

    f25d6b99e30f5c689eb4e8112d5fa8a58529aeb36d6d9b7905b9e5eec94bdac4

  • SHA512

    7db0d59d63e9d92c234fb9c374b910c7cfcec972e874a57a41e014d7786dea5da63d7a686750ac73a9c1ed568fff2a1f5426730bc953077c8f7851fb118dfd53

  • SSDEEP

    24576:ZrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tva0h5z:Z2EYTb8atv1orq+pEiSDTj1VyvBa0h

  Score

  10^/10

  discoveryexecutionadwindpersistencetrojan

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

    trojanadwind

  • Adwind family

    adwind

  • Class file contains resources related to AdWind

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2