File name:

Kafan_Sample_d06a88f0edeaf77c468dbabb3580bc6ba4812be5eec6cb8446b9f7f41bcc2494.jar

Full analysis: https://app.any.run/tasks/f0bf0269-eb78-48cc-aec1-9fb53823d4d4
Verdict: Malicious activity
Threats:

Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.

Analysis date: May 30, 2020, 07:22:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
adwind
rat
Indicators:
MIME: application/java-archive
File info: Java archive data (JAR)
MD5:

BCF2D1A52DCBAA0A5AF0867DF9E1287D

SHA1:

3AB1CCE1CC4D351680F39AD199EDB361A50C9D2F

SHA256:

D06A88F0EDEAF77C468DBABB3580BC6BA4812BE5EEC6CB8446B9F7F41BCC2494

SSDEEP:

96:UVtx7MmLa9EoxR7ouqA+j24UmWX9QEtFvCJDEbyjfLJA0fpIb43N7xBh3glP:Ix7box5pqAvjja9UyjdApE3N1OP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Creates files in the user directory

      • javaw.exe (PID: 632)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • javaw.exe (PID: 632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jar | Java Archive (78.3)
.zip | ZIP compressed archive (21.6)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: Deflated
ZipModifyDate: 2020:05:25 09:15:11
ZipCRC: 0x00000000
ZipCompressedSize: 2
ZipUncompressedSize: -
ZipFileName: META-INF/
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start javaw.exe node.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\Desktop\Kafan_Sample_d06a88f0edeaf77c468dbabb3580bc6ba4812be5eec6cb8446b9f7f41bcc2494.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\javaw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3192C:\Users\admin\qnodejs-node-v13.13.0-win-x86\node.exe C:\Users\admin\qnodejs-node-v13.13.0-win-x86\qnodejs\wizard.js start --group user:7@qhub-subscription.store.qua.one --register-startup --central-base-url https://central.qhub.qua.one --central-base-url https://3769683.middlegate.qua.one --central-base-url https://fake1.3769683.middlegate.qua.one --central-base-url invalid.https://3769683.middlegate.qua.oneC:\Users\admin\qnodejs-node-v13.13.0-win-x86\node.exejavaw.exe
User:
admin
Company:
Node.js
Integrity Level:
MEDIUM
Description:
Node.js: Server-side JavaScript
Exit code:
0
Version:
13.13.0
Total events
7
Read events
7
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
1 750
Unknown types
11

Dropped files

PID
Process
Filename
Type
632javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\node.exe
MD5:
SHA256:
632javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:
SHA256:
632javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\install_tools.battext
MD5:4E46AD93BAC466280DED1D0C19863A26
SHA256:4B1E875422E7A3BA28DC1A618E7569A27E2A491C161E0ADB742434B14F773BED
632javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
632javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\node_modules\npm\bin\npmtext
MD5:BA553D663CD364A71842375B7613DED2
SHA256:C7326730E2E51652DC605BCA7CEE7199E6362DD6AE97C8352586E8E96D2CD9D1
632javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\node_etw_provider.mantext
MD5:1D51E18A7247F47245B0751F16119498
SHA256:1975AA34C1050B8364491394CEBF6E668E2337C3107712E3EECA311262C7C46F
632javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\node_modules\npm\.licensee.jsontext
MD5:B133415ABE39E5C1865AAD84712B3941
SHA256:66218BC67A524799BA7CCAD7C493A8D24EEED81C07BED24E0C3034ABA6014061
632javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\node_modules\npm\bin\node-gyp-bin\node-gyp.cmdtext
MD5:BB78133F243EC53A16C89C436AB54216
SHA256:8CB8B915E6F433F7F8994EAE04E74595D5A169D1E593833BB4A5F2CBE213F02D
632javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\nodevars.battext
MD5:E6636C5B093F5CC13DFB7508305B8D8B
SHA256:A2B020E2F641524C6FD1B8EBBCD9EE03C7DC44009F2B78E701E773AD048BE9A5
632javaw.exeC:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\node_modules\npm\.mailmaptext
MD5:50FF5F4745B5210D1DDC6CB3AD21216B
SHA256:EC219650D5ED44D58B1F6CD6E8CCC116E118D7569E09ED19E9B80F5C8BE87D5B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
3
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
632
javaw.exe
104.20.23.46:443
nodejs.org
Cloudflare Inc
US
shared
64.225.101.88:443
central.qhub.qua.one
Peer 1 Network (USA) Inc.
US
malicious

DNS requests

Domain
IP
Reputation
nodejs.org
  • 104.20.23.46
  • 104.20.22.46
whitelisted
central.qhub.qua.one
  • 64.225.101.88
whitelisted

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
No debug info