MALICIOUS — 194961bb17454a32303da16892cb476dd98bd2833c4b08aa904895a439579da5

MALICIOUS — 194961bb17454a32303da16892cb476dd98bd2833c4b08aa904895a439579da5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Juko family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 194961bb17454a32303da16892cb476dd98bd2833c4b08aa904895a439579da5
SHA-1: bc7a9d4dbaef1909a4d2391d8aee3f14bb6b7105
MD5: 9e2c2c8f628ccf39270c2696ca2d5e45
imphash: 170193414cc4abf0ae27dc2a19d74879
ssdeep: 768:qZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqKNPWQHpH:OLsF2Kerc64sTiX2IV0DhuH
TLSH: T1A430396647309602F391A68B55403F4DB0B6A8EE3136C7518EE2B67E8BE045738B847C
Submitted as: 194961bb17454a32303da16892cb476dd98bd2833c4b08aa904895a439579da5
File type: pe · Size: 36868 bytes
Verdict: malicious (100/100) · Family: Juko

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Juko-9753236-0
Microsoft Defender: Trojan:Win32/SelfDel!pz
Emsisoft (Emergency Kit): Trojan.Downloader.JUKO
Kaspersky (KVRT): HEUR:Trojan.Win32.SelfDel.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Juko-9753236-0 (rule Win.Malware.Juko-9753236-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/SelfDel!pz (rule Trojan:Win32/SelfDel!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Downloader.JUKO (rule Trojan.Downloader.JUKO) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.SelfDel.gen (rule HEUR:Trojan.Win32.SelfDel.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 29 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

14916 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Mozilla\WINWORD.exe - 7f24671f5132f568846dcce236762e1e2709aaaca8e5ea86f2bc8e3442e3f3b3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://i.assmio.com/25ECA6A88BCD1F6D0000148D0022B125.html
http://i.assmio.com/264CF6AD8BCD215800001C04F9327685.aspx
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://i.assmio.com/26BA56AC8BCD23490000237CB035C61A.html
http://i.assmio.com/26DC56AC8BCD23EA000025FD6C3CE8BF.html
http://i.assmio.com/664056AC8B60014500002AE8470BF36F.shtm
http://i.assmio.com/666266AD8B6001E600002D6C22151C9D.430D

Embedded domains

i.assmio.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.182.143.212
4.230.171.124
40.84.97.4
52.230.60.54
74.178.76.128
135.232.92.97
135.232.92.137
51.132.193.104
4.150.223.99
48.211.4.16
52.110.12.55
52.110.12.52
172.237.146.49
135.234.160.244
51.104.15.252
72.153.5.138
52.148.114.188
52.110.12.53
52.110.12.20

More Juko samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report