MALICIOUS — 672_VolatileCedar.Explosion.bin

MALICIOUS — 672_VolatileCedar.Explosion.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Explosive family. 9 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 52cb02da0462fdd08d537b2c949e2e252f7a7a88354d596e9f5c9f1498d1c68f
• SHA-1: edc165e7e833a5e5345f675467398fb38cf6c16f
• MD5: 034e4c62965f8d5dd5d5a2ce34a53ba9
• imphash: 04ad2abcc93e6155ad98cbbf7d84da76
• ssdeep: 6144:FP/443+dYgkzGGbeX3xHLTpyrPqWTdpcZnrPNmZMiTwvHuQaDqIZ3oOk:Fo4OyxbeH15ynTdpcPsZlwG1DqIZ1k
• TLSH: T1A04A9D410F176749F6E38B908C14AD1D50B7BCAA21BF398C4BDBD49F6AD789B610082D
• Submitted as: 672_VolatileCedar.Explosion.bin
• File type: pe · Size: 426966 bytes
• Verdict: malicious (100/100) · Family: Explosive

Detections (9 of 52 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Trojan.Explosive-6479674-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
• Cyble Vision: Cyble Vision: Malicious
• Microsoft Defender: Worm:Win32/Hokobot.A!dha
• Emsisoft (Emergency Kit): Gen:Variant.Midie.101963
• Trellix Stinger (McAfee): Generic.dgg
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1057
• T1056.001
• T1543.003
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Explosive-6479674-0 (rule Win.Trojan.Explosive-6479674-0) - engine signal, weight 0.90, confidence 0.95
• Cyble Vision flagged Cyble Vision: Malicious (rule Cyble Vision: Malicious) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Worm:Win32/Hokobot.A!dha (rule Worm:Win32/Hokobot.A!dha) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Midie.101963 (rule Gen:Variant.Midie.101963) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Generic.dgg (rule Generic.dgg) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (windows)

13685 behavior events · 2 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• searchapp.bundleassets.example
• desktop-hsgcbep
• licensing.mp.microsoft.com
• config.edge.skype.com
• v10.events.data.microsoft.com
• settings-win.data.microsoft.com
• login.live.com
• fd.api.iris.microsoft.com
• windows.msn.com
• officeclient.microsoft.com
• www.bing.com
• sdx.microsoft.com
• nav.smartscreen.microsoft.com
• fe3cr.delivery.mp.microsoft.com
• dns.msftncsi.com
• assets.msn.com
• www.microsoft.com
• oloobe.officeapps.live.com

Dropped files

• /opt/CAPEv2/storage/analyses/6111/files/23adc598b0f7df71d52b7bdd2435df08944b7eb405a39286167774de6101af11 - 23adc598b0f7df71d52b7bdd2435df08944b7eb405a39286167774de6101af11
• /opt/CAPEv2/storage/analyses/6111/files/b8ab89dd822ebe4dc614d3a9f0f9a8e96fefc643d3d4e1fc521477fe9064de64 - b8ab89dd822ebe4dc614d3a9f0f9a8e96fefc643d3d4e1fc521477fe9064de64
• /opt/CAPEv2/storage/analyses/6111/files/803c7f59fdf4f79d74d57379d9eabdf0e08c1766c0fcfa116ecb76df04a94e3d - 803c7f59fdf4f79d74d57379d9eabdf0e08c1766c0fcfa116ecb76df04a94e3d

Embedded URLs

• http://www.microsoft.com/en-us/default.aspx

Embedded domains

• www.google.com
• www.microsoft.com
• inference.location.live.net
• aefd.nelreports.net

Embedded IP addresses

• 162.159.36.2

Registry keys

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

File paths

• c:\windows\wvhelp.exe
• c:\windows\

More Explosive samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report