MALICIOUS — 90c9a0bb6f3283968298a27c1bee4a68dbf4436a2cd4f95e0adfe9de19472a58

MALICIOUS — 90c9a0bb6f3283968298a27c1bee4a68dbf4436a2cd4f95e0adfe9de19472a58 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the VJadtre family. 7 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 90c9a0bb6f3283968298a27c1bee4a68dbf4436a2cd4f95e0adfe9de19472a58
SHA-1: dd1a550027263b0ac38038347013b4758b88c6f4
MD5: 3ab1d9f2c28e5130fdaca8cb1a5a6d81
imphash: e38062877caac65585afa2d2c3200df4
ssdeep: 768:aW29n/P4/C9tY+gJXo2QGPL4vzZq2o9W7GsxBbPr:wPZnYrotGCq2iW7z
TLSH: T1232DBFCE0B543D8ED9CAD912F484CE1C1B07AAAC2639758C5907E52F51309AB6C39E4C
Submitted as: 90c9a0bb6f3283968298a27c1bee4a68dbf4436a2cd4f95e0adfe9de19472a58
File type: pe · Size: 28672 bytes
Verdict: malicious (100/100) · Family: VJadtre

Detections (7 of 52 engines)

ClamAV (daily): Win.Malware.Wapomi-10020301-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Kaspersky (KVRT): Virus.Win32.Nimnul.f
Microsoft Defender: Virus:Win32/Mikcer.B
Emsisoft (Emergency Kit): Win32.VJadtre.3
Trellix Stinger (McAfee): Trojan-FVWC!3AB1D9F2C28E

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Wapomi-10020301-0 (rule Win.Malware.Wapomi-10020301-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Madeba): 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - dynamic signal, weight 0.80, confidence 0.90
Kaspersky (KVRT) flagged Virus.Win32.Nimnul.f (rule Virus.Win32.Nimnul.f) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 39 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13007 behavior events · 2 ATT&CK techniques · 50 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10649/files/4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
/opt/CAPEv2/storage/analyses/10649/files/0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91 - 0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91
/opt/CAPEv2/storage/analyses/10649/files/9e5bd6419a540d9bdcb16eb58340bf93bb1a22dc8a2e280942521ba3a7f72784 - 9e5bd6419a540d9bdcb16eb58340bf93bb1a22dc8a2e280942521ba3a7f72784
/opt/CAPEv2/storage/analyses/10649/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/10649/files/920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0 - 920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0
/opt/CAPEv2/storage/analyses/10649/files/f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379 - f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379
/opt/CAPEv2/storage/analyses/10649/files/079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4 - 079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4
/opt/CAPEv2/storage/analyses/10649/files/de59616a585b8a59cb3fa1b22ca7023c6f20d182a92f6f1af4e2cdc342bea676 - de59616a585b8a59cb3fa1b22ca7023c6f20d182a92f6f1af4e2cdc342bea676
/opt/CAPEv2/storage/analyses/10649/files/bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a - bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a
/opt/CAPEv2/storage/analyses/10649/files/4683286417ca3e7a675f511719b7ed8823bd47b1233fe7c8bf1eeb63a7807e59 - 4683286417ca3e7a675f511719b7ed8823bd47b1233fe7c8bf1eeb63a7807e59
/opt/CAPEv2/storage/analyses/10649/files/81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508 - 81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508
/opt/CAPEv2/storage/analyses/10649/files/249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a - 249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a
/opt/CAPEv2/storage/analyses/10649/files/e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c - e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c
/opt/CAPEv2/storage/analyses/10649/files/7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1 - 7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1
/opt/CAPEv2/storage/analyses/10649/files/81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7 - 81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786458697&P2=404&P3=2&P4=OOj2ukVXEuGFBcxjN%2ffyZSpuQlDRRs2TYOh0DCaveeovtKcQUmYVNtsFgM%2f3fMXeURbqGjx5zzNDAyDzH7WZOA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786458764&P2=404&P3=2&P4=gfzS92DNB%2b%2fhBajEhLrCEXLUCwzjE5FFq7%2fVAbBsIl32x5Az1fItmMN2F09eCuic10Vin9vV%2f7n0slfq%2bLzSKw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ddos.dnsnb8.net

Embedded IP addresses

203.26.79.13
135.232.92.34
4.150.223.106
4.247.188.233
52.253.84.76
4.230.171.124
20.165.94.63
135.232.92.97
52.168.117.169
4.150.223.102
48.211.4.16
74.179.71.159
172.178.240.161
92.223.78.30
3.229.117.57
52.110.12.51
52.110.12.53
142.251.222.238
72.154.7.108
52.148.114.188
52.110.12.33
52.110.12.52

More VJadtre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report