File: d5d3d46881d8061bb3679aee67715f38bebefb6251eb3fdfa4a58596db8f5b16
Metadata
| d5d3d46881d8061bb3679aee67715f38bebefb6251eb3fdfa4a58596db8f5b16_jrat.jar | |
| Java Jar file data (zip) | 98866 bytes |
| 2016-11-14 06:45:53 | |
| d93dd17a9adf84ca2839708d603d3bd6 | |
| ddca2db7b7ac42d8a4a23c2e8ed85de5e91dbf29 | |
| d5d3d46881d8061bb3679aee67715f38bebefb6251eb3fdfa4a58596db8f5b16 | |
| 8793eeae9f49ab9e7c54827a47f1992dc93a84c9cafe81f841310ece69d4fc7b560e2b7f227ba7720ab92b49b578309b474a3b7a40c8f0f4382455ea3c05fbea | |
| 3072:SO0lCfVEDZgh8hBPFAYtPhRiWo9rzAz202:7MCfd+hB9Aqi1K2 | |
| N/A | |
| N/A | |
APTNotes
Cyber threat intelligence reports associated with d5d3d46881d8061bb3679aee67715f38bebefb6251eb3fdfa4a58596db8f5b16.
Cyber threat intelligence reports associated with d5d3d46881d8061bb3679aee67715f38bebefb6251eb3fdfa4a58596db8f5b16.
Domains
Domains the malware sample communicates with.
Domains the malware sample communicates with.
| Domain | IP |
|---|---|
| p0.corotext.com | 213.247.47.190 |
Hosts
Hosts the malware sample communicates with.
Hosts the malware sample communicates with.
HTTP Requests
HTTP requests the malware sample makes.
HTTP requests the malware sample makes.
AV Detections
AV detection names associated with the malware sample.
AV detection names associated with the malware sample.
| ALYac | Java.Adwind.B |
| AVG | Exploit.Java_c.RAG |
| Ad-Aware | Java.Adwind.B |
| AhnLab-V3 | JAVA/Adwind |
| Arcabit | Java.Adwind.B |
| Avast | Java:Malware-gen [Trj] |
| Avira | JAVA/Adwind.gfs |
| BitDefender | Java.Adwind.B |
| CAT-QuickHeal | Trojan.Java.Adwind.B |
| Cyren | Java/Adwind.R |
| DrWeb | Java.Adwind.35 |
| ESET-NOD32 | Java/Adwind.HR |
| Emsisoft | Java.Adwind.B (B) |
| F-Prot | Java/Adwind.R |
| F-Secure | Java.Adwind.B |
| Fortinet | Java/Adwind.HR!tr |
| GData | Java.Adwind.B |
| Ikarus | Trojan.Java.Adwind |
| Kaspersky | Backdoor.Java.Agent.w |
| McAfee | BackDoor-FCRJ!Adwind |
| McAfee-GW-Edition | BackDoor-FCRJ!Adwind |
| MicroWorld-eScan | Java.Adwind.B |
| Microsoft | Trojan:Java/Adwind.J |
| Sophos | Troj/JavaDL-XO |
| Symantec | Trojan.Maljava |
| Tencent | Java.Backdoor.Agent.Wqwr |
| TrendMicro | JAVA_KRYPTIK.NNG |
| ViRobot | JAVA.S.Adwind.98866[h] |
| Zillya | Downloader.OpenConnection.JS.131828 |
| nProtect | Java.Adwind.B |
Mutants
Mutants created by the malware sample.
Mutants created by the malware sample.
Registry keys
Registry keys created by the malware sample.
Registry keys created by the malware sample.
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\IMM |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers |
| HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF |
| HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\SystemShared |
| HKEY_CURRENT_USER\Control Panel\Desktop |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced |
| HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\comdlg32 |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\comdlg32\PlacesBar |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ThemeManager |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DnsCache\Parameters |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DnsClient |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSClient |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run |
| HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004 |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\SOFTWARE\Microsoft\Cryptography\Providers\Type 001 |
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Offload |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1547161642-507921405-839522115-1004 |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment |
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName |
| ActiveComputerName |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Windows NT\CurrentVersion\Winlogon |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Environment |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Volatile Environment |
| HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography |
| HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Cryptography\UserKeys\J2SE |
| HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Cryptography |
Comments
User comments about d5d3d46881d8061bb3679aee67715f38bebefb6251eb3fdfa4a58596db8f5b16.
User comments about d5d3d46881d8061bb3679aee67715f38bebefb6251eb3fdfa4a58596db8f5b16.
