MALICIOUS — 46560e160a0b32ae83b7c441a57d12d076a33c449d9a0472a6c6a7bf126f4480

MALICIOUS — 46560e160a0b32ae83b7c441a57d12d076a33c449d9a0472a6c6a7bf126f4480 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Juko family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 46560e160a0b32ae83b7c441a57d12d076a33c449d9a0472a6c6a7bf126f4480
SHA-1: 512a95f8ee2e30b232ab5fbf426c710c59cc49f7
MD5: 82abbe749d7ec29ef861b6a28103d619
imphash: 170193414cc4abf0ae27dc2a19d74879
ssdeep: 768:qZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqKNPWQHpz:OLsF2Kerc64sTiX2IV0Dhuz
TLSH: T12E2F396647309602F391E68B55403F4DB0B6A8EE3136C7518EE2B67E8BE045738B847C
Submitted as: 46560e160a0b32ae83b7c441a57d12d076a33c449d9a0472a6c6a7bf126f4480
File type: pe · Size: 32784 bytes
Verdict: malicious (100/100) · Family: Juko

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Juko-9753236-0
Microsoft Defender: Trojan:Win32/SelfDel!pz
Emsisoft (Emergency Kit): Trojan.Downloader.JUKO
Kaspersky (KVRT): HEUR:Trojan.Win32.SelfDel.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Juko-9753236-0 (rule Win.Malware.Juko-9753236-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/SelfDel!pz (rule Trojan:Win32/SelfDel!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Downloader.JUKO (rule Trojan.Downloader.JUKO) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.SelfDel.gen (rule HEUR:Trojan.Win32.SelfDel.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 29 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

14899 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Mozilla\WINWORD.exe - d8491b3edc51001e4c6b5d9ec105410e4f050ff4da45f98709450695b241e2ac

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://i.assmio.com/248E36AA8C3E71FE000015289F4392DF.shtm
http://i.assmio.com/24EB86AF8C3E73EF00001CA521580BA3.aspx
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://i.assmio.com/254BA6A88C3E75CF00002406D7505A39.shtm
http://i.assmio.com/649366AD8BDE527E000025A84B7D7753.shtm
http://i.assmio.com/64EF46AB8BDE53FE00002B7B7E2E8CDF.856T
http://i.assmio.com/64F086AF8BDE545E00002D06F27FC2D9.892R

Embedded domains

i.assmio.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.12
4.230.171.124
57.154.63.210
20.247.184.142
135.233.95.144
20.184.175.15
74.178.76.54
172.64.154.167
4.207.44.76
162.159.142.9
52.110.12.47
52.110.12.15
48.211.4.16
172.233.212.151
52.148.114.188
92.223.78.30
52.110.12.10
72.154.7.98

More Juko samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report