MALICIOUS — 9ebeb6f76bcc7244044889b59406cbf2f4d8679c97ebceb30bbb78f683cf71c1

MALICIOUS — 9ebeb6f76bcc7244044889b59406cbf2f4d8679c97ebceb30bbb78f683cf71c1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the VJadtre family. 7 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 9ebeb6f76bcc7244044889b59406cbf2f4d8679c97ebceb30bbb78f683cf71c1
SHA-1: 11b825709bba5fef825bd8ca0429130631cd107a
MD5: 0f58f7be08d1537903440ba6167c1929
imphash: e38062877caac65585afa2d2c3200df4
ssdeep: 768:WV29n/P4/CSoY+gJX6kQGPL4vzZq2o9W7GsxBbPr:FPZhYr63GCq2iW7z
TLSH: T1E92DBFCE0B543E89D9CAD911F484CF1C2B07EAAC2639758C6903E52F517096B6C29F4C
Submitted as: 9ebeb6f76bcc7244044889b59406cbf2f4d8679c97ebceb30bbb78f683cf71c1
File type: pe · Size: 28672 bytes
Verdict: malicious (100/100) · Family: VJadtre

Detections (7 of 52 engines)

ClamAV (daily): Win.Malware.Wapomi-10020301-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Kaspersky (KVRT): Virus.Win32.Nimnul.f
Microsoft Defender: Virus:Win32/Mikcer.B
Emsisoft (Emergency Kit): Win32.VJadtre.3
Trellix Stinger (McAfee): Trojan-FVWC!0F58F7BE08D1

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Wapomi-10020301-0 (rule Win.Malware.Wapomi-10020301-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Madeba): 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 928) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 39 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12819 behavior events · 2 ATT&CK techniques · 50 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10629/files/4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
/opt/CAPEv2/storage/analyses/10629/files/0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91 - 0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91
/opt/CAPEv2/storage/analyses/10629/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/10629/files/920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0 - 920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0
/opt/CAPEv2/storage/analyses/10629/files/f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379 - f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379
/opt/CAPEv2/storage/analyses/10629/files/079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4 - 079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4
/opt/CAPEv2/storage/analyses/10629/files/b68fcbf584df10671bfddd810421b522e7f0cae272159710c039c09851eb61e6 - b68fcbf584df10671bfddd810421b522e7f0cae272159710c039c09851eb61e6
/opt/CAPEv2/storage/analyses/10629/files/bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a - bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a
/opt/CAPEv2/storage/analyses/10629/files/81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508 - 81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508
/opt/CAPEv2/storage/analyses/10629/files/249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a - 249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a
/opt/CAPEv2/storage/analyses/10629/files/e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c - e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c
/opt/CAPEv2/storage/analyses/10629/files/7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1 - 7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1
/opt/CAPEv2/storage/analyses/10629/files/81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7 - 81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7
/opt/CAPEv2/storage/analyses/10629/files/62aab98528514ce16def0b896fe9b756bd8f2589e641f2da204380fc08e75297 - 62aab98528514ce16def0b896fe9b756bd8f2589e641f2da204380fc08e75297
/opt/CAPEv2/storage/analyses/10629/files/96970542bbf06079f47e9cc3e959ebbf3cc4e3a8a7dd80e29cc9f76387427d5a - 96970542bbf06079f47e9cc3e959ebbf3cc4e3a8a7dd80e29cc9f76387427d5a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786458308&P2=404&P3=2&P4=OMFUu4VzFCJoOBDCN0OfAvQKNWBro%2bTv57py8Ziq8BkHq%2bjJTteNQzPfa%2bocOYe3NC4IQhrIZhpkHKHcuM85eg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786458349&P2=404&P3=2&P4=DwsU1Ug8JOxuYqM6o%2fBvg7cRlhPfGDbUg1Ze9tQqIb0LWnhMXCgaSLx2HVR7Y4VWxHv2bsORNfn2ZD0YuCQpYg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/_-4iFwfCacM.crl

Embedded domains

ddos.dnsnb8.net

Embedded IP addresses

51.116.253.170
4.230.171.124
4.247.188.233
57.155.104.224
52.253.84.76
20.247.184.142
74.179.77.204
74.178.76.54
52.182.143.212
40.74.98.196
172.178.240.163
52.110.12.47
52.110.12.48
3.229.117.57
203.26.79.13
74.178.76.44
52.123.252.195
72.145.35.99
142.251.222.3
135.233.95.80
52.110.12.37
52.148.114.188
52.110.12.30

More VJadtre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report