MALICIOUS — 43f2b3b2dd5e94c93f0feea61136c97db81ae78d2bf9ee79fcd0a2d2366fa88e

MALICIOUS — 43f2b3b2dd5e94c93f0feea61136c97db81ae78d2bf9ee79fcd0a2d2366fa88e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Juko family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 43f2b3b2dd5e94c93f0feea61136c97db81ae78d2bf9ee79fcd0a2d2366fa88e
SHA-1: 32b5be55e71b5d844ea774862a4890a0fefce7bf
MD5: 008b71d2bbaa9f5ddcbd2e17add8d0e3
imphash: 170193414cc4abf0ae27dc2a19d74879
ssdeep: 768:qZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqKNPWQHpI:OLsF2Kerc64sTiX2IV0DhuI
TLSH: T1BA2F396647309602F391E68B55403F4DB0B6A9EE3136C7518EE2B67E8BE045738B847C
Submitted as: 43f2b3b2dd5e94c93f0feea61136c97db81ae78d2bf9ee79fcd0a2d2366fa88e
File type: pe · Size: 32784 bytes
Verdict: malicious (100/100) · Family: Juko

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Juko-9753236-0
Microsoft Defender: Trojan:Win32/SelfDel!pz
Emsisoft (Emergency Kit): Trojan.Downloader.JUKO
Kaspersky (KVRT): HEUR:Trojan.Win32.SelfDel.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Juko-9753236-0 (rule Win.Malware.Juko-9753236-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/SelfDel!pz (rule Trojan:Win32/SelfDel!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Downloader.JUKO (rule Trojan.Downloader.JUKO) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.SelfDel.gen (rule HEUR:Trojan.Win32.SelfDel.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 29 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

14908 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Mozilla\WINWORD.exe - bb3418e8f50364d4ad863db907badb7b7900a69474fd0d887e70550d960084e7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://i.assmio.com/116876AE8C3E145A000014498653CBC8.508C
http://i.assmio.com/11C5C6AA8C3E164B00001BD711687AA9.aspx
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://i.assmio.com/123616A88C3E183C00002338B860C6CC.html
http://i.assmio.com/517DD6AB8BCDF4EF000025A8D83FAE4A.html
http://i.assmio.com/51C926A98BCDF63F00002AA46F3FFADB.shtm
http://i.assmio.com/51EB36AA8BCDF6D000002D178E30FDAB.368S

Embedded domains

aefd.nelreports.net
i.assmio.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.89.1.8
172.215.188.225
4.230.171.124
20.247.185.124
74.178.76.128
4.150.223.112
74.178.76.54
74.179.77.204
172.64.154.167
20.184.175.3
92.223.78.30
48.211.4.16
172.234.31.13
20.42.73.28
13.69.116.104
72.153.5.130
52.148.114.188
52.110.12.16
52.110.12.32

More Juko samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report