MALICIOUS — 8af1fd1626dd59955b531d135ea4dc942833ac8deaba67979e7a3e58460ba2a1

MALICIOUS — 8af1fd1626dd59955b531d135ea4dc942833ac8deaba67979e7a3e58460ba2a1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the VJadtre family. 7 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 8af1fd1626dd59955b531d135ea4dc942833ac8deaba67979e7a3e58460ba2a1
SHA-1: 9e296aa002cb235d585d36465f79713f0925886b
MD5: 92e2e4ab9e7e6140fc3a001fc7a00099
imphash: e38062877caac65585afa2d2c3200df4
ssdeep: 768:WV29n/P4/CSoY+gJXMxQGPL4vzZq2o9W7GsxBbPr:FPZhYrM2GCq2iW7z
TLSH: T1492DBFCE0B543E89D9CAD911F484CE1C2B07EAAC2639758C6903E52F517096B6C39F4C
Submitted as: 8af1fd1626dd59955b531d135ea4dc942833ac8deaba67979e7a3e58460ba2a1
File type: pe · Size: 28672 bytes
Verdict: malicious (100/100) · Family: VJadtre

Detections (7 of 52 engines)

ClamAV (daily): Win.Malware.Wapomi-10020301-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Microsoft Defender: Virus:Win32/Mikcer.B
Emsisoft (Emergency Kit): Win32.VJadtre.3
Trellix Stinger (McAfee): Trojan-FVWC!92E2E4AB9E7E
Kaspersky (KVRT): Virus.Win32.Nimnul.f

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Wapomi-10020301-0 (rule Win.Malware.Wapomi-10020301-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Madeba): 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Virus:Win32/Mikcer.B (rule Virus:Win32/Mikcer.B) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.VJadtre.3 (rule Win32.VJadtre.3) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FVWC!92E2E4AB9E7E (rule Trojan-FVWC!92E2E4AB9E7E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Nimnul.f (rule Virus.Win32.Nimnul.f) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 36 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13715 behavior events · 2 ATT&CK techniques · 50 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/10826/files/c78c98d724d2bec5826c9a9aa9798d1d0592f36a8513ea4991f556188a6b1af5 - c78c98d724d2bec5826c9a9aa9798d1d0592f36a8513ea4991f556188a6b1af5
/opt/CAPEv2/storage/analyses/10826/files/4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07 - 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
/opt/CAPEv2/storage/analyses/10826/files/0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91 - 0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91
/opt/CAPEv2/storage/analyses/10826/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/10826/files/920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0 - 920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0
/opt/CAPEv2/storage/analyses/10826/files/f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379 - f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379
/opt/CAPEv2/storage/analyses/10826/files/daa387f5d588bab2db670fdcf5a33cd05617316bd0e2c27e22988b9a3154be26 - daa387f5d588bab2db670fdcf5a33cd05617316bd0e2c27e22988b9a3154be26
/opt/CAPEv2/storage/analyses/10826/files/079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4 - 079771f6478bb63f24119685df1262ea2735295a3022ba6c1d509650800797e4
/opt/CAPEv2/storage/analyses/10826/files/bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a - bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a
/opt/CAPEv2/storage/analyses/10826/files/81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508 - 81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508
/opt/CAPEv2/storage/analyses/10826/files/249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a - 249b0d96ae8bc49c773c0054b8a6d05f689cbcd9abc9572d30bfb2a2bac36b1a
/opt/CAPEv2/storage/analyses/10826/files/e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c - e91dc258304b42180887679f892e47587a8d67d1140ffb3e8acf79deb95cdb9c
/opt/CAPEv2/storage/analyses/10826/files/7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1 - 7e42b39d55f1ad07551daedacb1d0191c4b9cefeadf0008766819626bac923c1
/opt/CAPEv2/storage/analyses/10826/files/81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7 - 81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7
/opt/CAPEv2/storage/analyses/10826/files/62aab98528514ce16def0b896fe9b756bd8f2589e641f2da204380fc08e75297 - 62aab98528514ce16def0b896fe9b756bd8f2589e641f2da204380fc08e75297

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786462695&P2=404&P3=2&P4=WKBynWQ3ALI5a%2bo4yvRrRrwShQdAJdh%2bCi2JXKM1pwBiDUVS%2bcs4HIJtMSATMF%2f1WtIG8SRKCJywO0UFjnBhMA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786462764&P2=404&P3=2&P4=G4tczA48mSERmcYfTIxGLb%2f7ulRvoygSEjOYlUO3ipMaOrgvz7IGnyZQskOzAU5gj8e4zBQPbtTz7SoChi8NpQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ddos.dnsnb8.net

Embedded IP addresses

52.168.117.168
52.123.252.234
40.84.85.40
20.247.185.124
4.230.171.124
74.178.240.61
74.179.77.164
52.168.112.66
20.42.65.90
52.123.252.244
172.178.240.163
3.229.117.57
203.26.79.13
52.123.252.225
20.165.94.46
52.123.252.242
52.110.12.3
52.110.12.19
52.123.252.198
52.148.114.188
72.153.5.138
52.110.12.20
52.110.12.2

More VJadtre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report