Overview

overview

10

Static

static

10

Sorillus.rar

windows7-x64

1

Sorillus.rar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Sorillus.rar

  • Size

    69.9MB

  • Sample

    250320-xxpd2s1k15

  • MD5

    a4a28906274f2395009d7e36f8c3e032

  • SHA1

    f09131c0175774adc141d0f02b923288efb95e10

  • SHA256

    c265f04f075e27e91611d7e88119823702801684bf39e48ca5c0a2232f994ece

  • SHA512

    efbabc19bec15249d26af7c0c90d242a715984440f96ac6a24b21d4773a1ac909039897054e576841eff313c6c580af00d435a25ce1b1becf562311ccac7df8c

  • SSDEEP

    1572864:hyC3saUVoVhrBWwDskPfUuuRWh0BFnRdKfSmPa3EbDv3:Q8saU2VBbQjzRWh0TyLy3Ef

Score
10/10
adwindtrojan

Malware Config

Targets

    • Target

      Sorillus.rar

    • Size

      69.9MB

    • MD5

      a4a28906274f2395009d7e36f8c3e032

    • SHA1

      f09131c0175774adc141d0f02b923288efb95e10

    • SHA256

      c265f04f075e27e91611d7e88119823702801684bf39e48ca5c0a2232f994ece

    • SHA512

      efbabc19bec15249d26af7c0c90d242a715984440f96ac6a24b21d4773a1ac909039897054e576841eff313c6c580af00d435a25ce1b1becf562311ccac7df8c

    • SSDEEP

      1572864:hyC3saUVoVhrBWwDskPfUuuRWh0BFnRdKfSmPa3EbDv3:Q8saU2VBbQjzRWh0TyLy3Ef

    Score
    10/10
    adwindtrojan

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • Adwind family

      adwind

    • Class file contains resources related to AdWind

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks