MALICIOUS — 1b7472dd013e9141391b59f3f8a26509a586d635deb6db49d462fb73194090e1

MALICIOUS — 1b7472dd013e9141391b59f3f8a26509a586d635deb6db49d462fb73194090e1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the VJadtre family. 7 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 1b7472dd013e9141391b59f3f8a26509a586d635deb6db49d462fb73194090e1
SHA-1: 94aea00590f70ee47d6e2298cce47930e491480e
MD5: 35a5776f68d6822423c109c9e726cbcc
imphash: e38062877caac65585afa2d2c3200df4
ssdeep: 768:aW29n/P4/C9tY+gJX9RQGPL4vzZq2o9W7GsxBbPr:wPZnYr9WGCq2iW7z
TLSH: T1A12DBFCE0B543D8DD9CAD912F4848E1C1B07EAAC2639758C5907E52F513096B6C39E4D
Submitted as: 1b7472dd013e9141391b59f3f8a26509a586d635deb6db49d462fb73194090e1
File type: pe · Size: 28672 bytes
Verdict: malicious (99/100) · Family: VJadtre

Detections (7 of 52 engines)

ClamAV (daily): Win.Malware.Wapomi-10020301-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Kaspersky (KVRT): Virus.Win32.Nimnul.f
Microsoft Defender: Virus:Win32/Mikcer.B
Emsisoft (Emergency Kit): Win32.VJadtre.3
Trellix Stinger (McAfee): Trojan-FVWC!35A5776F68D6

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Wapomi-10020301-0 (rule Win.Malware.Wapomi-10020301-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Madeba): 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 4 finding(s), e.g. RWX/private injected region in svchost.exe (pid 984) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 38 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

14425 behavior events · 1 ATT&CK techniques · 50 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10641/files/4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
/opt/CAPEv2/storage/analyses/10641/files/0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91 - 0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91
/opt/CAPEv2/storage/analyses/10641/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/10641/files/920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0 - 920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0
/opt/CAPEv2/storage/analyses/10641/files/f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379 - f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379
/opt/CAPEv2/storage/analyses/10641/files/61b3b29c8795a2d8251d6c88ca4249361f740316332cedc08782eb1008d8662b - 61b3b29c8795a2d8251d6c88ca4249361f740316332cedc08782eb1008d8662b
/opt/CAPEv2/storage/analyses/10641/files/77484b6456b98e6ee29f66c07fa16c32a41037df88399430636bd4366721a447 - 77484b6456b98e6ee29f66c07fa16c32a41037df88399430636bd4366721a447
/opt/CAPEv2/storage/analyses/10641/files/079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4 - 079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4
/opt/CAPEv2/storage/analyses/10641/files/bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a - bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a
/opt/CAPEv2/storage/analyses/10641/files/81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508 - 81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508
/opt/CAPEv2/storage/analyses/10641/files/249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a - 249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a
/opt/CAPEv2/storage/analyses/10641/files/e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c - e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c
/opt/CAPEv2/storage/analyses/10641/files/7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1 - 7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1
/opt/CAPEv2/storage/analyses/10641/files/90c138f83e28b3f5ab2a9128188267a69df4ddba3e27ca74e32803663e52987b - 90c138f83e28b3f5ab2a9128188267a69df4ddba3e27ca74e32803663e52987b
/opt/CAPEv2/storage/analyses/10641/files/81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7 - 81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786458529&P2=404&P3=2&P4=iMBm%2fDx4ZWVlqq9tXR6fme83lYmVTCvSx4zhcYxyCUrgGFNV55C0%2bEN8sombhjPiDHMSuoOVolCXsDSlYbGKvg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786458608&P2=404&P3=2&P4=k6dxCiMGVYHQYO888yiuCkI9elOxctF1P2m11YPQG%2bVtk5ABDJEq1x%2b80E7chWYTMue%2bD%2fN2MM2p2LsEpOaHXQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ddos.dnsnb8.net

Embedded IP addresses

57.155.104.224
52.168.117.169
52.123.252.220
52.230.59.222
4.230.171.124
48.211.4.16
74.179.77.204
135.233.95.135
20.184.175.12
203.26.79.13
172.178.240.162
3.229.117.57
52.123.252.192
135.232.92.34
52.123.252.193
52.110.12.49
52.110.12.44
52.123.252.213
72.145.35.116
52.148.114.188
52.110.12.22
52.110.12.16

More VJadtre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report