MALICIOUS — 293f782faa5a5e636ce466403ad3883e299b82487c1b4ffa219c105f160f584d

MALICIOUS — 293f782faa5a5e636ce466403ad3883e299b82487c1b4ffa219c105f160f584d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the SelfDel family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 293f782faa5a5e636ce466403ad3883e299b82487c1b4ffa219c105f160f584d
SHA-1: 7dce37fcb0a0acce8bad59b06b9b4fe95c848989
MD5: a8fd9df13dab0e84733723b6e22b82f0
imphash: 170193414cc4abf0ae27dc2a19d74879
ssdeep: 768:qZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqKNPWQHpx:OLsF2Kerc64sTiX2IV0Dhux
TLSH: T1D330396647309602F391A68B55403F4DB0B6A9EE3136C7518EE2B67E8BE045738B847C
Submitted as: 293f782faa5a5e636ce466403ad3883e299b82487c1b4ffa219c105f160f584d
File type: pe · Size: 36872 bytes
Verdict: malicious (100/100) · Family: SelfDel

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Juko-9753236-0
Microsoft Defender: Trojan:Win32/SelfDel!pz
Emsisoft (Emergency Kit): Trojan.Downloader.JUKO
Kaspersky (KVRT): HEUR:Trojan.Win32.SelfDel.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Juko-9753236-0 (rule Win.Malware.Juko-9753236-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/SelfDel!pz (rule Trojan:Win32/SelfDel!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Downloader.JUKO (rule Trojan.Downloader.JUKO) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.SelfDel.gen (rule HEUR:Trojan.Win32.SelfDel.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 32 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

14788 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Mozilla\WINWORD.exe - b1dda7832dd677bcd405531d67f33bf43c6fac2447a59c95114647b73e44e172

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://i.assmio.com/189266AD8EAE69E400001870E85203D7.html
http://i.assmio.com/18FFB6A98EAE6BDC00001FFD895682F0.aspx
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://i.assmio.com/58AE36AA8E414A490000269130031135.html
http://i.assmio.com/58BF06A78E414A8D0000276F3F2BBE29.shtm
http://i.assmio.com/590E86AF8E414C3A00002DFCF60C63AA.246I
http://i.assmio.com/591F26A98E414C6D00002ECAE63E09AA.228O

Embedded domains

i.assmio.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

51.116.246.105
52.123.252.218
4.144.132.114
4.247.188.233
4.230.171.124
74.178.76.54
20.184.175.20
135.232.92.137
20.42.65.85
52.123.252.234
74.178.240.61
172.237.146.49
172.64.154.167
92.223.78.30
52.148.114.188
72.154.7.113
52.110.12.1
52.110.12.15

More SelfDel samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report