MALICIOUS — 114efb67a288e4a0b857b7fa9dcf90f8e0397dc947cc49d3507f2d7a48ee452e

MALICIOUS — 114efb67a288e4a0b857b7fa9dcf90f8e0397dc947cc49d3507f2d7a48ee452e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Juko family. 4 of 55 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 114efb67a288e4a0b857b7fa9dcf90f8e0397dc947cc49d3507f2d7a48ee452e
SHA-1: b2ee85f62d4922b8f80540ab4e2bc62ebfbcc994
MD5: 10aba6a4e0dbaab1b5bbb93f92cdac25
imphash: 170193414cc4abf0ae27dc2a19d74879
ssdeep: 768:qZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqKNPWQHpS:OLsF2Kerc64sTiX2IV0DhuS
TLSH: T16230396647309602F391A68B55403F4DB0B6A8EE3136C7518EE2B67E8BE045738B847C
Submitted as: 114efb67a288e4a0b857b7fa9dcf90f8e0397dc947cc49d3507f2d7a48ee452e
File type: pe · Size: 36872 bytes
Verdict: malicious (99/100) · Family: Juko

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Juko-9753236-0
Microsoft Defender: Trojan:Win32/SelfDel!pz
Emsisoft (Emergency Kit): Trojan.Downloader.JUKO
Kaspersky (KVRT): HEUR:Trojan.Win32.SelfDel.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Juko-9753236-0 (rule Win.Malware.Juko-9753236-0) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (30 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

15160 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Mozilla\WINWORD.exe - 33553b86d22e66b7b1dc7b877971a7926f6558a24d7407361327d0987089d452

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://i.assmio.com/0BC576AE87E460A700001427A14642EB.aspx
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787870781&P2=404&P3=2&P4=gp%2fhTokTLHjtywEf6h74EBcJoMF2EFAWXoXG%2b01C%2fN6YXqZZJoZd1ESxlXpkSkTAgM4HhY2zLye1chIZfkzTkA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://i.assmio.com/0C25C6AA87E4629100001BB56B4CFEAC.shtm
http://i.assmio.com/0C8BE6AC87E464710000232712584A27.460I
http://i.assmio.com/4BC9D6AB878740E9000024EB930C0404.shtm
http://i.assmio.com/4C1886AF8787425B00002A8BC92E7CCD.aspx
http://i.assmio.com/4C3A36AA878742DA00002C5A4A055391.778L

Embedded domains

i.assmio.com

Embedded IP addresses

4.150.223.102
20.42.179.192
4.230.171.124
52.230.59.222
40.84.97.4
20.165.94.63
74.178.76.54
52.168.112.66
52.123.129.14
20.236.44.162
52.123.128.14
40.99.134.18
40.99.134.2
52.168.117.169
172.178.240.161
52.123.252.195
52.168.117.171
52.178.17.234
203.26.79.13
52.148.114.188
172.233.212.151
52.123.252.234
74.179.71.159
72.145.35.109
52.110.12.56

More Juko samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report