MALICIOUS — 2da1c17c3cbf87865e9bfe8fdf0b5f4e886f1e0b5fbd736b2da7afb44144bde3

MALICIOUS — 2da1c17c3cbf87865e9bfe8fdf0b5f4e886f1e0b5fbd736b2da7afb44144bde3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the VJadtre family. 7 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 2da1c17c3cbf87865e9bfe8fdf0b5f4e886f1e0b5fbd736b2da7afb44144bde3
SHA-1: adbf4bbf2233e3ae34e17cb5673f739174eafb21
MD5: 68bc0b1ec40ebfc0a95bbdf12b21f1db
imphash: e38062877caac65585afa2d2c3200df4
ssdeep: 768:aW29n/P4/C9tY+gJXkFQGPL4vzZq2o9W7GsxBbPr:wPZnYrkiGCq2iW7z
TLSH: T10A2DBFCE0B543E8DD9CAD912F484CE1C1B07AAAC2679758C6907E52F51309AB6C39F4C
Submitted as: 2da1c17c3cbf87865e9bfe8fdf0b5f4e886f1e0b5fbd736b2da7afb44144bde3
File type: pe · Size: 28672 bytes
Verdict: malicious (100/100) · Family: VJadtre

Detections (7 of 52 engines)

ClamAV (daily): Win.Malware.Wapomi-10020301-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Microsoft Defender: Virus:Win32/Mikcer.B
Emsisoft (Emergency Kit): Win32.VJadtre.3
Trellix Stinger (McAfee): Trojan-FVWC!68BC0B1EC40E
Kaspersky (KVRT): Virus.Win32.Nimnul.f

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Wapomi-10020301-0 (rule Win.Malware.Wapomi-10020301-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Madeba): 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Virus:Win32/Mikcer.B (rule Virus:Win32/Mikcer.B) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.VJadtre.3 (rule Win32.VJadtre.3) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FVWC!68BC0B1EC40E (rule Trojan-FVWC!68BC0B1EC40E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Nimnul.f (rule Virus.Win32.Nimnul.f) - engine signal, weight 0.55, confidence 0.85
Contacted 38 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13311 behavior events · 1 ATT&CK techniques · 50 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10799/files/4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
/opt/CAPEv2/storage/analyses/10799/files/0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91 - 0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91
/opt/CAPEv2/storage/analyses/10799/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/10799/files/920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0 - 920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0
/opt/CAPEv2/storage/analyses/10799/files/f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379 - f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379
/opt/CAPEv2/storage/analyses/10799/files/079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4 - 079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4
/opt/CAPEv2/storage/analyses/10799/files/bc7b5d394356a0e94b7c4a09bd6a9a33a6ad83f9b920fc8e4b2eb871a529fa9d - bc7b5d394356a0e94b7c4a09bd6a9a33a6ad83f9b920fc8e4b2eb871a529fa9d
/opt/CAPEv2/storage/analyses/10799/files/bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a - bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a
/opt/CAPEv2/storage/analyses/10799/files/bd3f4d9e0887ba5d6e6da527ff5281828dd482ea4fb0e1ba781d72e4d7fe3901 - bd3f4d9e0887ba5d6e6da527ff5281828dd482ea4fb0e1ba781d72e4d7fe3901
/opt/CAPEv2/storage/analyses/10799/files/81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508 - 81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508
/opt/CAPEv2/storage/analyses/10799/files/249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a - 249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a
/opt/CAPEv2/storage/analyses/10799/files/e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c - e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c
/opt/CAPEv2/storage/analyses/10799/files/7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1 - 7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1
/opt/CAPEv2/storage/analyses/10799/files/81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7 - 81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7
/opt/CAPEv2/storage/analyses/10799/files/62aab98528514ce16def0b896fe9b756bd8f2589e641f2da204380fc08e75297 - 62aab98528514ce16def0b896fe9b756bd8f2589e641f2da204380fc08e75297

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786461943&P2=404&P3=2&P4=KmBiMJtC5m%2bZu9NxpJaKsB2jrh59iMX1HGO15ontuiZiZIcA8NCZFtTVq3wXKQETmW4BsDr3l3jEcQTL3%2fIsXA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786462009&P2=404&P3=2&P4=RrrEmuB4%2fN5huzYIEtyVUH17dKQCh8P1vcF8I8pUmV5zKLsSILlDAIu651xXUlSsC5SicJ5uDESRV6JkoI%2fBHA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/_-4iFwfCacM.crl

Embedded domains

ddos.dnsnb8.net

Embedded IP addresses

20.184.175.10
20.42.179.204
4.230.171.124
20.247.184.142
20.165.94.63
135.232.92.97
52.168.117.168
135.233.95.144
20.42.65.91
74.178.232.29
203.26.79.13
135.233.45.223
3.229.117.57
57.154.63.210
52.110.12.55
52.110.12.20
72.154.7.97
52.148.114.188
92.223.78.30
142.250.195.227
52.110.12.25
52.110.12.47

More VJadtre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report