adwind

Resubmissions

21-06-2024 17:31

240621-v3p7esydnh 10

14-06-2024 18:11

240614-wszhsa1eje 10

Sharing

Copy URL

Twitter E-mail

General

Target

ab1286fa7650738e0b821bebf04ade41_JaffaCakes118
Size

4.8MB
Sample

240621-v3p7esydnh
MD5

ab1286fa7650738e0b821bebf04ade41
SHA1

3f839fa95db110d547592d1f8bd1ef359a9da4df
SHA256

18f99597514fed8f0218a32736d142c5038fd9a711a47c6aceb8b8ed39eae6dc
SHA512

db9a52c0634c1c32e4d2f99a75b703789e0f28de7a1095b660b03e70c780d34d96549aca51d982813fb18032b24edacb00609db3c7d1b58c09537c12b290fc3b
SSDEEP

24576:Vo2Yq+JFAA6MOrm/KPO/lYq0L0YPLU8OpRZvZLbU4lL525r2zjWYu7XZTj5Ilzrb:V6fyFq7vuINqd7M99/L

Score

10^/10

Malware Config

Extracted

Family

xtremerat

iaficasioo.zapto.org

Targets

- Target
  
  ab1286fa7650738e0b821bebf04ade41_JaffaCakes118
- Size
  
  4.8MB
- MD5
  
  ab1286fa7650738e0b821bebf04ade41
- SHA1
  
  3f839fa95db110d547592d1f8bd1ef359a9da4df
- SHA256
  
  18f99597514fed8f0218a32736d142c5038fd9a711a47c6aceb8b8ed39eae6dc
- SHA512
  
  db9a52c0634c1c32e4d2f99a75b703789e0f28de7a1095b660b03e70c780d34d96549aca51d982813fb18032b24edacb00609db3c7d1b58c09537c12b290fc3b
- SSDEEP
  
  24576:Vo2Yq+JFAA6MOrm/KPO/lYq0L0YPLU8OpRZvZLbU4lL525r2zjWYu7XZTj5Ilzrb:V6fyFq7vuINqd7M99/L
Score

10^/10

adwind lokibot xtremerat collection persistence rat spyware stealer trojan upx discovery evasion
- AdWind
  A Java-based RAT family operated as malware-as-a-service.
  trojan adwind
- Class file contains resources related to AdWind
- Detect XtremeRAT payload
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- UAC bypass
  evasion trojan
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables Task Manager via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2