MALICIOUS — 651_VolatileCedar.Explosion.bin

MALICIOUS — 651_VolatileCedar.Explosion.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Explosive family. 9 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 5d491ea5705e90c817cf0f5211c9edbcd5291fe8bd4cc69cdb58e8d0e6b6d1fe
• SHA-1: e057d5bb1693e1989d75df7fa77082e1ef18ca2a
• MD5: 3f35c97e9e87472030b84ae1bc932ffc
• imphash: 04ad2abcc93e6155ad98cbbf7d84da76
• ssdeep: 6144:ED/46x51zacOY8srInuxP28JLFZs/SBijGb8sZX4DLRuQaDqIZ3IY+:EM6D1AsrIuB2qZsHjU8s+D41DqIZb+
• TLSH: T1624AAE410F176649F6E38B908C14AD1D40B3ACBA31BF299C4BDBD45F6ADB89F610092D
• Submitted as: 651_VolatileCedar.Explosion.bin
• File type: pe · Size: 426980 bytes
• Verdict: malicious (100/100) · Family: Explosive

Detections (9 of 52 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Trojan.Explosive-6479674-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
• Cyble Vision: Cyble Vision: Malicious
• Microsoft Defender: Worm:Win32/Hokobot.A!dha
• Emsisoft (Emergency Kit): Gen:Variant.Midie.101963
• Trellix Stinger (McAfee): Generic.dgg
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1057
• T1056.001
• T1543.003
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Explosive-6479674-0 (rule Win.Trojan.Explosive-6479674-0) - engine signal, weight 0.90, confidence 0.95
• Cyble Vision flagged Cyble Vision: Malicious (rule Cyble Vision: Malicious) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Worm:Win32/Hokobot.A!dha (rule Worm:Win32/Hokobot.A!dha) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Midie.101963 (rule Gen:Variant.Midie.101963) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Generic.dgg (rule Generic.dgg) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (windows)

15445 behavior events · 2 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• searchapp.bundleassets.example
• desktop-hsgcbep
• v10.events.data.microsoft.com
• config.edge.skype.com
• settings-win.data.microsoft.com
• login.live.com
• www.bing.com
• fd.api.iris.microsoft.com
• licensing.mp.microsoft.com
• windows.msn.com
• officeclient.microsoft.com
• sdx.microsoft.com
• fe3cr.delivery.mp.microsoft.com
• dns.msftncsi.com
• assets.msn.com
• www.microsoft.com
• oloobe.officeapps.live.com
• tas02.sls.update.microsoft.com

Dropped files

• /opt/CAPEv2/storage/analyses/6124/files/359694e8faa2bbd3a9c8f75e441b1ff77383496b6cb29b852304db8adc45d32a - 359694e8faa2bbd3a9c8f75e441b1ff77383496b6cb29b852304db8adc45d32a
• /opt/CAPEv2/storage/analyses/6124/files/b8ab89dd822ebe4dc614d3a9f0f9a8e96fefc643d3d4e1fc521477fe9064de64 - b8ab89dd822ebe4dc614d3a9f0f9a8e96fefc643d3d4e1fc521477fe9064de64
• /opt/CAPEv2/storage/analyses/6124/files/b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209 - b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

Embedded URLs

• http://www.microsoft.com/en-us/default.aspx

Embedded domains

• www.google.com
• www.microsoft.com
• inference.location.live.net
• aefd.nelreports.net

Embedded IP addresses

• 162.159.36.2

Registry keys

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

File paths

• c:\windows\wvhelp.exe
• c:\windows\

More Explosive samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report