Malspam email with a JAR attachment. Hybrid Analysis reports it as showing Adwind RAT specific behavior.
Date/time:
2018-05-27T23:28:52
"sender" from:
“Hellen Huang”<tamilnet@tamilnet[.]com>
Sender IP: 46.183.221.123
ASN: 52048
ISP: DataClub S.A.
Shodan.io/Censys.io for lasthop(s):
https://www.shodan.io/46.183.221.123
https://www.censys.io/ipv4/46.183.221.123
Headers received:
from User (unknown [46[.]183[.]221[.]123]) by mail[.]tameshkbazi[.]ir (Postfix) with ESMTPA id 5059E6A992; Mon, 28 May 2018 01:28:51 +0200 (CEST)
Helo:
mail[.]tameshkbazi[.]ir
Headers x-mailer:
none
Subject line(s):
PAYMENT ORDER
Message Body:
“Dear sir / Madam Our company is interested to buy your product to meet the need of our growing market. Please qoute according the eclosed purchase order, and specify your payment terms and delivery time. Kind Regards Hellen Huang Purchase Manager Kazmini Limited Rio de Janeiro”
Attachments:
Name: PAYMENT ORDER.jar
MD5: c84567d61e206e38f83e407d0b33a0d2
SHA1: 471b6d192ec7f045b452ee70fffaa97abdb87cbc
SHA256: 0d0ef1c7d3e5df528c52c6a4fb132571aeda864b39cef38e90ac61bb3b654c9d
SHA512: 5bb2001b42e9240155f5572e58153292bd546612108cb9f01bf23188e9e502521059903430626206fca69c3a52bd7d95e333ede04745f638e37191692914c543
File type: Java archive data (JAR)
File size: 700521
Virus Total: https://www.virustotal.com/#/file/0d0ef1c7d3e5df528c52c6a4fb132571aeda864b39cef38e90ac61bb3b654c9d/detection
https://www.hybrid-analysis.com/sample/0d0ef1c7d3e5df528c52c6a4fb132571aeda864b39cef38e90ac61bb3b654c9d/5b0b77a17ca3e1168920b3b0