MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50878530510b1fb7aca04f2425e7da0b6f13bf74bf55ed40672a0bfda0d0e990. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Jadtre


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50878530510b1fb7aca04f2425e7da0b6f13bf74bf55ed40672a0bfda0d0e990
SHA3-384 hash: 83e69324d40a37719b21bee0022aac74965a744afd0da1ee35f2c1a120b130c2f53196933d1b1fade66e4c24d38204b0
SHA1 hash: e1d2e641d0f2b2f0d7a028a25ae085fc1bab4ca4
MD5 hash: dc1bd242216e92123861985ca9deab02
humanhash: mockingbird-lactose-virginia-potato
File name:aef644fc899f0079bcbbae4ed030e34b
Download: download sample
Signature Jadtre
Create hunting rule
File size:27'136 bytes
First seen:2020-11-17 14:41:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 87bed5a7cba00c7e1f4015f1bdae2183 (3'034 x Jadtre, 23 x IcedID, 17 x Blackmoon)
ssdeep 768:xd5u7mNGtyVfaDQGPL4vzZq2oZ7GTxBcBtu:xd5z/fDGCq2w7n
Threatray 1'311 similar samples on MalwareBazaar
TLSH 5DC2D072CD8080FFC0CB3472208522CB9F575A72556A78A7A750981E7DBCDE0E97A753
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Malware.Vtflooder-6260355-1
Create hunting rule

Win.Malware.Cerbu-9789017-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Changing an executable file
Creating a window
DNS request
Connection attempt
Sending an HTTP POST request
Modifying an executable file
Creating a file
Running batch commands
Creating a process with a hidden window
Connection attempt to an infection source
Infecting executable files
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/50878530510b1fb7aca04f2425e7da0b6f13bf74bf55ed40672a0bfda0d0e990/
Threat name:
Win32.Virus.Jadtre
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 14:42:27 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
4cc131a892f5e19a38d60c85e21c8d21204b0c45debacb867861f8720ba942b8
Jadtre
537ecc8713722940804903c4be7c6d282311a4e4a95f43443bd16f089508acce
Jadtre
58458e32ef321e1b99e7f34eb10ba5ae2a2958e4f3d84c72630299ea8d076234
Jadtre
6bae0aecae3f305e19c35cb9cd94ad39267f4210615fd3d41c99640a07d7ab5f
Jadtre
87e1b300b54ced91dbbc4a87f242a43ad614cb8edd485d7cbdf0f8d3e7d209dd
Jadtre
8a0e0736baa61d531a4a5c3a8af1295d6ef589fa559a85426293f3c3801123cb
Jadtre
9522d24f7b905e5b2cba9b8e6f274a9fe755f24e02fbe0e0658be3b857fa4106
Jadtre
bcd613abd04a2c38de237f399efefd148716ef58d6672b9b3d985f594ab84ebe
Jadtre
db007b70d6c4f1958ca5cef98e5467b1cc360c46c10430514536179c465b028d
Jadtre
e435f55afe2b0008cbea33ce32ea65fd54a8e7986a773a75c330621827df9b2d
Jadtre
+ 1'301 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
50878530510b1fb7aca04f2425e7da0b6f13bf74bf55ed40672a0bfda0d0e990
MD5 hash:
dc1bd242216e92123861985ca9deab02
SHA1 hash:
e1d2e641d0f2b2f0d7a028a25ae085fc1bab4ca4
Link:
https://www.unpac.me/results/1d78841c-0656-4eca-9ebe-a9cc5641b5c6/
SH256 hash:
1ccf4a454ba80c34512419a6f7d8c76f70f2ec8171083560246f1bc16afcc8c8
MD5 hash:
250053d8b17de5ced3866aa69483fa3d
SHA1 hash:
1ed132e0f636e5998ce3bb4383784e1bf7790d11
Detections:
win_unidentified_045_g0
Create hunting rule
win_unidentified_045_auto
Create hunting rule
Link:
https://www.unpac.me/results/1d78841c-0656-4eca-9ebe-a9cc5641b5c6/
SH256 hash:
76bb746cce9ceb4d48d1c27cb90673efeda3bac9df2e9e85fbbfd7e85773ca13
MD5 hash:
290ca998085520e3205c080beb277d99
SHA1 hash:
a9ccc17e80b2f696687efa60aa4db06bb974b33a
Link:
https://www.unpac.me/results/1d78841c-0656-4eca-9ebe-a9cc5641b5c6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Vflooder
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/50878530510b1fb7aca04f2425e7da0b6f13bf74bf55ed40672a0bfda0d0e990

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments