MALICIOUS — 047_Duqu2.bin
MALICIOUS — 047_Duqu2.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Duqu family. 5 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
6e09e1a4f56ea736ff21ad5e188845615b57e1a5168f4bdaebe7ddc634912de9 - SHA-1:
00170bf9983e70e8dd4f7afe3a92ce1d12664467 - MD5:
a14a6fb62d7efc114b99138a80b6dc7d - imphash:
25097b4bacbce35beb1ad24027b8b014 - ssdeep:
384:vy5YD9564P2bUfolBd7P7KhkL/xbkEiDtRgd:Ca2ofolr7PekLlctRg - TLSH:
T17A28E60757749FB1FBDA6EE0A8D3CD7E10B1EE65A83EA461C102C81E55E4D031932639 - Submitted as: 047_Duqu2.bin
- File type: pe · Size: 17408 bytes
- Verdict: malicious (99/100) · Family: Duqu
Detections (5 of 51 engines)
- ClamAV (daily): {MD5}bin.trojan.duqu.7907.UNOFFICIAL
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Trojan:Win32/Duqu!pz
- Emsisoft (Emergency Kit): Trojan.Duqu.E
- Trellix Stinger (McAfee): PWS-Duqu.b!A14A6FB62D7E
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged {MD5}bin.trojan.duqu.7907.UNOFFICIAL (rule
{MD5}bin.trojan.duqu.7907.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Duqu!pz (rule
Trojan:Win32/Duqu!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Duqu.E (rule
Trojan.Duqu.E) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged PWS-Duqu.b!A14A6FB62D7E (rule
PWS-Duqu.b!A14A6FB62D7E) - engine signal, weight 0.55, confidence 0.85 - Memory forensics: 5 finding(s), e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
100 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- searchapp.bundleassets.example
- desktop-hsgcbep
- v10.events.data.microsoft.com
- login.live.com
- settings-win.data.microsoft.com
- config.edge.skype.com
- fd.api.iris.microsoft.com
- www.bing.com
- windows.msn.com
- officeclient.microsoft.com
- licensing.mp.microsoft.com
- dns.msftncsi.com
- 192.168.122.108
- 224.0.0.252
- 192.168.122.255
- 192.168.122.1
- 192.168.122.105
- 224.0.0.22
Embedded domains
- inference.location.live.net
More Duqu samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report