MALICIOUS — 7a341eae96e8921d3f2033156fe9e8b7e816134d4c3eba1c9274b8dd78c68898

MALICIOUS — 7a341eae96e8921d3f2033156fe9e8b7e816134d4c3eba1c9274b8dd78c68898 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the VJadtre family. 7 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 7a341eae96e8921d3f2033156fe9e8b7e816134d4c3eba1c9274b8dd78c68898
SHA-1: 95a50b5c9398bd5333f0c3cf7a5cd76d5af25e58
MD5: 19c50a5e57394e9f86befa2ffc6c809e
imphash: e38062877caac65585afa2d2c3200df4
ssdeep: 768:aW29n/P4/C9tY+gJX1DQGPL4vzZq2o9W7GsxBbPr:wPZnYr1UGCq2iW7z
TLSH: T1A72DBFCE0B543E8DD9CAD912F484CE1C1B07AAAC2639758C6903E52F51309AB6C39E4C
Submitted as: 7a341eae96e8921d3f2033156fe9e8b7e816134d4c3eba1c9274b8dd78c68898
File type: pe · Size: 28672 bytes
Verdict: malicious (100/100) · Family: VJadtre

Detections (7 of 52 engines)

ClamAV (daily): Win.Malware.Wapomi-10020301-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Microsoft Defender: Virus:Win32/Mikcer.B
Emsisoft (Emergency Kit): Win32.VJadtre.3
Trellix Stinger (McAfee): Trojan-FVWC!19C50A5E5739
Kaspersky (KVRT): Virus.Win32.Nimnul.f

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Wapomi-10020301-0 (rule Win.Malware.Wapomi-10020301-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Madeba): 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Virus:Win32/Mikcer.B (rule Virus:Win32/Mikcer.B) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.VJadtre.3 (rule Win32.VJadtre.3) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FVWC!19C50A5E5739 (rule Trojan-FVWC!19C50A5E5739) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Nimnul.f (rule Virus.Win32.Nimnul.f) - engine signal, weight 0.55, confidence 0.85
Contacted 40 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13091 behavior events · 1 ATT&CK techniques · 50 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10760/files/4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
/opt/CAPEv2/storage/analyses/10760/files/0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91 - 0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91
/opt/CAPEv2/storage/analyses/10760/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/10760/files/920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0 - 920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0
/opt/CAPEv2/storage/analyses/10760/files/f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379 - f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379
/opt/CAPEv2/storage/analyses/10760/files/079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4 - 079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4
/opt/CAPEv2/storage/analyses/10760/files/99bcd0cff4b9d1a0888ae3ecb5fb35b69fb9fe3749cd804a1cc10333645d3702 - 99bcd0cff4b9d1a0888ae3ecb5fb35b69fb9fe3749cd804a1cc10333645d3702
/opt/CAPEv2/storage/analyses/10760/files/bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a - bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a
/opt/CAPEv2/storage/analyses/10760/files/81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508 - 81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508
/opt/CAPEv2/storage/analyses/10760/files/249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a - 249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a
/opt/CAPEv2/storage/analyses/10760/files/e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c - e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c
/opt/CAPEv2/storage/analyses/10760/files/7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1 - 7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1
/opt/CAPEv2/storage/analyses/10760/files/81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7 - 81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7
/opt/CAPEv2/storage/analyses/10760/files/62aab98528514ce16def0b896fe9b756bd8f2589e641f2da204380fc08e75297 - 62aab98528514ce16def0b896fe9b756bd8f2589e641f2da204380fc08e75297
/opt/CAPEv2/storage/analyses/10760/files/96970542bbf06079f47e9cc3e959ebbf3cc4e3a8a7dd80e29cc9f76387427d5a - 96970542bbf06079f47e9cc3e959ebbf3cc4e3a8a7dd80e29cc9f76387427d5a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786461139&P2=404&P3=2&P4=E3JPoLHJ1tUFq4S%2fAwpHDcH%2brvnncw8%2bxs7SICHDKmWQlGnwQIr%2byqxngENFrDSyjgVjbXp%2fpmFtBQ%2bV6ISZoA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786461206&P2=404&P3=2&P4=DpMPj80MShWeMbm2e8Lh28Muk9GXwHkAhO5h3FYPqKpjY4HscpLArnidzytAbbM8j8T4fFAsCsJfDbF4SuPW6w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/_-4iFwfCacM.crl

Embedded domains

ddos.dnsnb8.net

Embedded IP addresses

4.247.188.233
4.150.223.106
203.26.79.13
20.247.185.124
4.230.171.124
40.84.85.40
74.178.76.128
135.233.95.135
20.42.65.85
20.184.175.16
52.110.12.21
52.110.12.54
135.234.160.245
3.229.117.57
20.184.175.14
4.150.223.115
52.123.252.222
20.165.94.46
142.250.195.163
135.232.92.34
72.154.7.98
52.110.12.49
52.148.114.188
52.110.12.14

More VJadtre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report