MALICIOUS — aa5415a1ca7e187571dc21a0b2633c8607216e87393508c7c9dad8eab42d7057

MALICIOUS — aa5415a1ca7e187571dc21a0b2633c8607216e87393508c7c9dad8eab42d7057 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Juko family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: aa5415a1ca7e187571dc21a0b2633c8607216e87393508c7c9dad8eab42d7057
SHA-1: 7383f0b6acc00239c5cf21745a410b8824861fb7
MD5: 8d8f869a15407879df2d1e5656fcd153
imphash: 170193414cc4abf0ae27dc2a19d74879
ssdeep: 768:qZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqKNPWQHpz:OLsF2Kerc64sTiX2IV0Dhuz
TLSH: T1F42F396747309602F391A68B55403F4DB1B6A8EE3136C7518EE2B67E8BE045738B847C
Submitted as: aa5415a1ca7e187571dc21a0b2633c8607216e87393508c7c9dad8eab42d7057
File type: pe · Size: 32788 bytes
Verdict: malicious (100/100) · Family: Juko

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Juko-9753236-0
Microsoft Defender: Trojan:Win32/SelfDel!pz
Emsisoft (Emergency Kit): Trojan.Downloader.JUKO
Kaspersky (KVRT): HEUR:Trojan.Win32.SelfDel.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Juko-9753236-0 (rule Win.Malware.Juko-9753236-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/SelfDel!pz (rule Trojan:Win32/SelfDel!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Downloader.JUKO (rule Trojan.Downloader.JUKO) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.SelfDel.gen (rule HEUR:Trojan.Win32.SelfDel.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 32 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

14913 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Mozilla\WINWORD.exe - 3f5a2ef2c2875e06aef055107110f6d631b691427528dee159ed6ed51801f62d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://i.assmio.com/5229A6A88A925F0B00001449662EFD0A.406U
http://i.assmio.com/528FF6AD8A9260FC00001BB5B93E6C3C.aspx
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://i.assmio.com/52FD16A88A9262DC000023276039B7BB.html
http://i.assmio.com/128B86AF8A3C40FA000027CC8956B529.aspx
http://i.assmio.com/12A4C6AA8A3C41A600002A9C4660DE09.086W
http://i.assmio.com/12E8A6A88A3C42DA00002F3B306900A1.html
http://i.assmio.com/131526A98A3C4390000031FAFC702D6C.html

Embedded domains

i.assmio.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.72.131
4.247.188.233
20.247.184.197
52.123.252.235
4.230.171.124
20.42.179.192
74.178.240.51
20.165.94.63
104.208.16.94
162.159.142.9
52.110.12.11
52.110.12.19
172.233.212.151
172.178.240.161
92.223.78.30
52.148.114.188
52.168.117.174
4.150.223.115
72.145.35.96
52.110.12.37
52.110.12.14

More Juko samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report