MALICIOUS — 3e22901e7b039f8e5f0abf40183e598b61c97eae4c8e518c5053be9bea070fe3

MALICIOUS — 3e22901e7b039f8e5f0abf40183e598b61c97eae4c8e518c5053be9bea070fe3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Juko family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 3e22901e7b039f8e5f0abf40183e598b61c97eae4c8e518c5053be9bea070fe3
SHA-1: c72f78b864688e013d91de307a8ce3ff76820af5
MD5: 0c43a7ae9bf44566c59f9398b4b819c6
imphash: 170193414cc4abf0ae27dc2a19d74879
ssdeep: 768:qZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqKNPWQHps:OLsF2Kerc64sTiX2IV0Dhus
TLSH: T11E2F396647309602F391A68B55403F4DB0B6A8EE3136C7519EE2B67E8BE045738B847C
Submitted as: 3e22901e7b039f8e5f0abf40183e598b61c97eae4c8e518c5053be9bea070fe3
File type: pe · Size: 32776 bytes
Verdict: malicious (100/100) · Family: Juko

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Juko-9753236-0
Microsoft Defender: Trojan:Win32/SelfDel!pz
Emsisoft (Emergency Kit): Trojan.Downloader.JUKO
Kaspersky (KVRT): HEUR:Trojan.Win32.SelfDel.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Juko-9753236-0 (rule Win.Malware.Juko-9753236-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/SelfDel!pz (rule Trojan:Win32/SelfDel!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Downloader.JUKO (rule Trojan.Downloader.JUKO) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.SelfDel.gen (rule HEUR:Trojan.Win32.SelfDel.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

15624 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Mozilla\WINWORD.exe - 768f71b0a7eca94cdbe2d85294b676b955a702f251ddedaead7f25c24c1da209

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://i.assmio.com/2E2956AC8F202CFB0000139D2B155830.shtm
http://i.assmio.com/2E8FA6A88F202EEC00001B2524281D9E.html
http://i.assmio.com/2EECF6AD8F2030D70000228CDB286CFF.shtm
http://i.assmio.com/6E3E56AC8EC00D6A000025189171A607.aspx
http://i.assmio.com/6E7266AD8EC00EA6000029F182719BBD.836P
http://i.assmio.com/6E9476AE8EC00F4A00002C8D4772F493.shtm

Embedded domains

i.assmio.com

Embedded IP addresses

13.69.116.108
4.230.171.124
40.84.85.40
20.247.184.142
104.18.33.89
74.178.240.51
135.232.92.137
4.150.223.102
92.223.78.30
51.116.246.106
172.66.2.5
4.150.223.105
52.110.12.10
52.110.12.3
172.234.31.13
125.56.205.65
125.56.205.123
52.148.114.188
172.215.188.225
20.42.65.93
172.172.255.218
72.154.7.107
52.110.12.33
52.110.12.30

More Juko samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report