MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfaa18aa4d93b9a4f5d3f898146fd148e4e92587e4190e7336bc43da82bbd443. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Jadtre


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfaa18aa4d93b9a4f5d3f898146fd148e4e92587e4190e7336bc43da82bbd443
SHA3-384 hash: 9d5981858356872fada56b4c167ab518baba7279f41cf85918d54f7b774cf18afd888d29a0ccf8969c47a2403fe8ffb8
SHA1 hash: d4b189942b4a782329378325a240c84283aefaf2
MD5 hash: 9e5ee2bcb2feb2298c79d42d5a9ecf06
humanhash: berlin-one-dakota-rugby
File name:aa5134c0bcc38b76b6a964eef7316d64
Download: download sample
Signature Jadtre
Create hunting rule
File size:27'136 bytes
First seen:2020-11-17 15:45:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 87bed5a7cba00c7e1f4015f1bdae2183 (3'034 x Jadtre, 23 x IcedID, 17 x Blackmoon)
ssdeep 768:Zd5u7mNGtyVfv52lQGPL4vzZq2oZ7GtxGry:Zd5z/fvwCGCq2w7j
Threatray 1'542 similar samples on MalwareBazaar
TLSH 3AC2D073CE8080FFC0CB3072208522CB9B575A72657A6867A750881E7DBCDE0EA76753
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Malware.Vtflooder-6260355-1
Create hunting rule

Win.Malware.Cerbu-9789017-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a window
Changing an executable file
DNS request
Connection attempt
Sending an HTTP POST request
Modifying an executable file
Creating a file
Running batch commands
Creating a process with a hidden window
Connection attempt to an infection source
Infecting executable files
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfaa18aa4d93b9a4f5d3f898146fd148e4e92587e4190e7336bc43da82bbd443/
Threat name:
Win32.Virus.Jadtre
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 15:54:39 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
26f81a13576b52b5fc7f9bf394d76c41c32ca3233920c77f890ab3951fcbf880
Jadtre
288e8a51aeb1d4e96bc2266af53994a859707cb34b349476795c7b748944c624
Jadtre
7571450da26cc89e30ed50825fbd3eb2dd9c97425e5ff68e91ed9ee12d376e97
Jadtre
9173194167a565cee337a8515558d89bd2e39872f17b844106cafdf9b1b5f1d9
Jadtre
a37ef25376e916665074211727ca47fd4d3f5c7804a73869cbc174354bc271f6
Jadtre
b46e751600a0bdf66d2b458c276ab36b480ffa452412667e4f2a14d1f2fb5490
Jadtre
b60129c7f2f76413b747bec0edd9aac71d4ab4d06d7cd2ed58151d123b6bf905
Jadtre
b78b5c7ef336e5aa2172a16e7cb0b3625e769fd4fd956ae7dfdee4ccf40a8cbb
Jadtre
c5103e03020820a35a9383b2d80db365bc405ce1b5ad13d8d0376f5cccdc3a5a
Jadtre
e15d042cd0f53d29d6e076b7d81a358b2cd96db9f80e609b7162df3930a39784
Jadtre
+ 1'532 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
cfaa18aa4d93b9a4f5d3f898146fd148e4e92587e4190e7336bc43da82bbd443
MD5 hash:
9e5ee2bcb2feb2298c79d42d5a9ecf06
SHA1 hash:
d4b189942b4a782329378325a240c84283aefaf2
Link:
https://www.unpac.me/results/64a43cdc-b664-4d57-ba58-161574df2809/
SH256 hash:
80cc4d364316a08ed1c8c36ff085a2ddd5cc520006ae7cbaf6778758edec12f8
MD5 hash:
abe2e447b5dab74ac777e46d88e03584
SHA1 hash:
85c184de543defc85ae5cd1c8eac4617c1710465
Detections:
win_unidentified_045_g0
Create hunting rule
win_unidentified_045_auto
Create hunting rule
Link:
https://www.unpac.me/results/64a43cdc-b664-4d57-ba58-161574df2809/
SH256 hash:
5822d776a537503817513cb5d7bd8650ef9fbe1dd5940ef7d18da310de472fcc
MD5 hash:
b8831be1b9ea41d677be7a37f3743876
SHA1 hash:
43cdad079c2cb38b2d4f304d00c09967e5ed7b49
Link:
https://www.unpac.me/results/64a43cdc-b664-4d57-ba58-161574df2809/
SH256 hash:
7bcc09b227b0cec434ce557075703f45480bdfc685808de0d525e0943e7cf7c1
MD5 hash:
52c9480fed0aee201d79ae610a65f085
SHA1 hash:
cb67be5c31b131a2a5fced8162855dd29692889e
Link:
https://www.unpac.me/results/64a43cdc-b664-4d57-ba58-161574df2809/
SH256 hash:
bcda0c6a9b8d72dc186766120b6da9b2f3a76c24f4ba53eb6849e353801898ec
MD5 hash:
92f84a043064d959f195c471148d154e
SHA1 hash:
dd0864c94e386f18dfc3bac0479998426a65cd86
Link:
https://www.unpac.me/results/64a43cdc-b664-4d57-ba58-161574df2809/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments