MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a91f6ee64a1c166971f4c85482ddda2ec63f348552e9eaf294bcb3a36b661d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Jadtre


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a91f6ee64a1c166971f4c85482ddda2ec63f348552e9eaf294bcb3a36b661d8
SHA3-384 hash: cd185a059ece4f62299adbbbd92ed7bf198957ab30229fbd622ebaecfa1d76f5e52d4c2178fe2aec033004f0b26ab735
SHA1 hash: 11278cd1ea1ff32300a4764836e28d825e7b9e19
MD5 hash: 379539b762b27300fe5748d063072cb5
humanhash: october-hawaii-low-oxygen
File name:b1e1f33e6f1424661ac1b5c0c03b0312
Download: download sample
Signature Jadtre
Create hunting rule
File size:27'136 bytes
First seen:2020-11-17 15:02:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 87bed5a7cba00c7e1f4015f1bdae2183 (3'034 x Jadtre, 23 x IcedID, 17 x Blackmoon)
ssdeep 768:hd5u7mNGtyVfM4lQGPL4vzZq2o9W7GexzmnO:hd5z/fjCGCq2iW7y
TLSH 0AC2D0B3CE80C4FFC0CB3472208511CB9B575A7295AA6867A710981E7DBCDE0DA76753
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Malware.Vtflooder-6260355-1
Create hunting rule

Win.Malware.Cerbu-9789017-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a window
Changing an executable file
DNS request
Connection attempt
Sending an HTTP POST request
Modifying an executable file
Creating a file
Running batch commands
Creating a process with a hidden window
Connection attempt to an infection source
Infecting executable files
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a91f6ee64a1c166971f4c85482ddda2ec63f348552e9eaf294bcb3a36b661d8/
Threat name:
Win32.Virus.Jadtre
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 15:15:17 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Unpacked files
SH256 hash:
4a91f6ee64a1c166971f4c85482ddda2ec63f348552e9eaf294bcb3a36b661d8
MD5 hash:
379539b762b27300fe5748d063072cb5
SHA1 hash:
11278cd1ea1ff32300a4764836e28d825e7b9e19
Link:
https://www.unpac.me/results/6a908107-becb-4d97-9663-79fde2f06198/
SH256 hash:
fd78cfd5534f6fb88f621eada4161797e778fc3bc26a997d0784ceb8955bf561
MD5 hash:
b415312d1b4a5d592447ac6a40bebaf5
SHA1 hash:
a901013c379b73ed016e07dfd3cfbcc9e50de53c
Detections:
win_unidentified_045_g0
Create hunting rule
win_unidentified_045_auto
Create hunting rule
Link:
https://www.unpac.me/results/6a908107-becb-4d97-9663-79fde2f06198/
SH256 hash:
e9df44e2668479f6c52371e53a146501cd6032479194acda0eaca96651b77bf8
MD5 hash:
e91675ee9a7234107d7840b0f522e3ad
SHA1 hash:
2f94c5783f21c00b6933ecb3c27417c3a9f8af66
Link:
https://www.unpac.me/results/6a908107-becb-4d97-9663-79fde2f06198/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments