MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52ed0a3b3787a82f968c7c407417e8c013e3c934087e57ac374e88759ad8f801. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Jadtre


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52ed0a3b3787a82f968c7c407417e8c013e3c934087e57ac374e88759ad8f801
SHA3-384 hash: cc4f632677b194837165b40ef0123c792f11f25ca8f81fe26ab6abe789ab20d8188bddc080062ff9132fe911cd63e3ea
SHA1 hash: b524d6699c8685abe5304c0bc5090e352010851b
MD5 hash: 5bda04f793ddd7c6e56d8429f9d14a98
humanhash: river-july-magnesium-enemy
File name:aa53c9b8303321d4af88ff77c0c05ad6
Download: download sample
Signature Jadtre
Create hunting rule
File size:27'136 bytes
First seen:2020-11-17 14:08:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 87bed5a7cba00c7e1f4015f1bdae2183 (3'034 x Jadtre, 23 x IcedID, 17 x Blackmoon)
ssdeep 768:qd5u7mNGtyVfQ/sQGPL4vzZq2oZ7GtxUx7p:qd5z/fEvGCq2w7R
Threatray 1'374 similar samples on MalwareBazaar
TLSH 2CC2C073CE8080FFC0CB3472204522CB9B535A72957A6867A750981E7DBCDE0D976753
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
50
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Malware.Vtflooder-6260355-1
Create hunting rule

Win.Malware.Cerbu-9789017-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a window
Changing an executable file
DNS request
Modifying an executable file
Connection attempt
Sending an HTTP POST request
Creating a file
Running batch commands
Creating a process with a hidden window
Connection attempt to an infection source
Infecting executable files
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52ed0a3b3787a82f968c7c407417e8c013e3c934087e57ac374e88759ad8f801/
Threat name:
Win32.Virus.Jadtre
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 14:09:29 UTC
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1535144d6528c2b1e4431bfe961b943ec7fee817fa0ccbdfe16cc4e6ffcb39e2
Jadtre
16b3e5ac83b21e077b1e4ec66a7ab4442a71bda9efe88c09c66e235874d64333
Jadtre
2367638c85441932cd9a1eecc90f6db90f0f64c10a8657479d86b088cd789c21
Jadtre
6768dfc7e3abd1146491c40bba95fb881fe52163ecd437e889741c5809d88c63
Jadtre
6bb2a9c618f6e062c9f005b2fbf708c4d80380abbc8a63472fe941c370e23e11
Jadtre
7854a2d8e4a16090ebfff10d09b0491bfc8e89e7a2edb2a5bb2b49477f6e776c
Jadtre
823040c20dd55365284aa7b8fc922e14d7f9d5aaeb2892401b4cf7262467ceb5
Jadtre
b1f5bfa07b6b2fe4625891fe1b804005b0bc9d9a267a560fd1a0a2b3c0cdc009
Jadtre
d60365e2214c6d1dac7f6788391812e51bb09915c73994d6fe171b52a2b306a9
Jadtre
dca55b1f37c20bcbe94606d3daeb04c40dfbdb5c89d0de9343058b542b5de0cc
Jadtre
+ 1'364 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
52ed0a3b3787a82f968c7c407417e8c013e3c934087e57ac374e88759ad8f801
MD5 hash:
5bda04f793ddd7c6e56d8429f9d14a98
SHA1 hash:
b524d6699c8685abe5304c0bc5090e352010851b
Link:
https://www.unpac.me/results/61cfc483-cb6e-4489-a0a9-7d029c5313e2/
SH256 hash:
bec6739e34efee2c2cd17e6f1e289140c5d061d16616000a4f88936a787f7eb0
MD5 hash:
2711933872ca03aa647425a098f15446
SHA1 hash:
c53017c252604006035aa215eeb6866c68ad9520
Detections:
win_unidentified_045_g0
Create hunting rule
win_unidentified_045_auto
Create hunting rule
Link:
https://www.unpac.me/results/61cfc483-cb6e-4489-a0a9-7d029c5313e2/
SH256 hash:
b4def6b8a6e5a6e696736ee61c5449d06493a40f68a8a055c2cabbba719b28cc
MD5 hash:
97745f4a9876ea92abeb70cde6e42553
SHA1 hash:
a6b8ed248d44e0a26bf165e61f0993b22ee1191b
Link:
https://www.unpac.me/results/61cfc483-cb6e-4489-a0a9-7d029c5313e2/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments