MALICIOUS — 859_Win32.Stuxnet.B.Duqu-Realtek.bin
MALICIOUS — 859_Win32.Stuxnet.B.Duqu-Realtek.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Stuxnet family. 6 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b - SHA-1:
c81e8e4af351161519c3a30db103aa2fd2abbf29 - MD5:
37fc7c5d89f1e5a96f54318df1a2b905 - imphash:
be2c3036d981fa5ac54d71ba4ce15c7d - ssdeep:
384:3pjc0UYZy1Ttvyph2adBRd64h+Erl2zB5ls7O7hBWnqTYJLWd6jqdybz:3p4U0Lm2aKF56iBOLAmIybz - TLSH:
T16D2C5B605079F25CF1A8BBF55761CC6F0051A8FB29F928C61983E46BB3BCC6B5431285 - Submitted as: 859_Win32.Stuxnet.B.Duqu-Realtek.bin
- File type: pe · Size: 25720 bytes
- Verdict: malicious (100/100) · Family: Stuxnet
Detections (6 of 52 engines)
- ClamAV (daily): {MD5}bin.trojan.agent.7527.UNOFFICIAL
- YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
- Microsoft Defender: Trojan:Win32/Stuxnet.E
- Emsisoft (Emergency Kit): Gen:Variant.Zusy.572070
- Trellix Stinger (McAfee): Stuxnet
- Kaspersky (KVRT): Worm.Win32.Stuxnet.b
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged {MD5}bin.trojan.agent.7527.UNOFFICIAL (rule
{MD5}bin.trojan.agent.7527.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8012) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Trojan:Win32/Stuxnet.E (rule
Trojan:Win32/Stuxnet.E) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Zusy.572070 (rule
Gen:Variant.Zusy.572070) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged Stuxnet (rule
Stuxnet) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Worm.Win32.Stuxnet.b (rule
Worm.Win32.Stuxnet.b) - engine signal, weight 0.55, confidence 0.85 - Contacted 20 external host(s) at runtime (10 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule
DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
91 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- licensing.mp.microsoft.com
- watson.events.data.microsoft.com
- msedge.api.cdp.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- kv801.prod.do.dsp.mp.microsoft.com
- cp801.prod.do.dsp.mp.microsoft.com
- msedge.b.tlu.dl.delivery.mp.microsoft.com
- edge.microsoft.com
Embedded URLs
- http://crl.verisign.com/tss-ca.crl0
- https://www.verisign.com/rpa
- https://www.verisign.com/rpa01
- http://crl.verisign.com/pca3.crl0
- http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0D
- https://www.verisign.com/rpa0
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786196138&P2=404&P3=2&P4=Hkx4%2b4pTZlipILDUv3P1itGauQhNmSzbCYJgFz91CBwOc3m2dkKMzST4kAffvOqnqa6%2bl3XPhN0EFO2Vi841jA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786196190&P2=404&P3=2&P4=frYA2N%2fp2T8fEZH51j9HF4d2K4%2bYOMFAfR3PC0essJ%2bMJq6OZXLgPqzVkNF3TzV1xg1uvlePLDfb5zlrGgHNqQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- crl.verisign.com
- www.verisign.com
- crl.microsoft.com
- csc3-2004-crl.verisign.com
Embedded IP addresses
- 51.116.253.168
- 4.230.171.124
- 52.230.60.54
- 135.234.160.244
- 74.179.71.159
- 203.26.79.13
- 72.153.5.133
- 52.110.12.32
- 52.110.12.46
- 52.148.114.188
More Stuxnet samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report