MALICIOUS — ac77b73517d7bdca25b0b30a52303b87c1547c990f9cb06aa597ad9d888c48cf

MALICIOUS — ac77b73517d7bdca25b0b30a52303b87c1547c990f9cb06aa597ad9d888c48cf is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Juko family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: ac77b73517d7bdca25b0b30a52303b87c1547c990f9cb06aa597ad9d888c48cf
SHA-1: df9d4365e64fb215627cd2410b6e92ad74278fd9
MD5: de8b146dc9e66a22f9a89656f8a4d777
imphash: 170193414cc4abf0ae27dc2a19d74879
ssdeep: 768:qZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqKNPWQHpN:OLsF2Kerc64sTiX2IV0DhuN
TLSH: T1C92F396647309602F391AA8B55403F4DB1B6A8EE3136C7518EE2B57E8BE045738B847C
Submitted as: ac77b73517d7bdca25b0b30a52303b87c1547c990f9cb06aa597ad9d888c48cf
File type: pe · Size: 32784 bytes
Verdict: malicious (100/100) · Family: Juko

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Juko-9753236-0
Microsoft Defender: Trojan:Win32/SelfDel!pz
Emsisoft (Emergency Kit): Trojan.Downloader.JUKO
Kaspersky (KVRT): HEUR:Trojan.Win32.SelfDel.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Juko-9753236-0 (rule Win.Malware.Juko-9753236-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/SelfDel!pz (rule Trojan:Win32/SelfDel!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Downloader.JUKO (rule Trojan.Downloader.JUKO) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.SelfDel.gen (rule HEUR:Trojan.Win32.SelfDel.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 30 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

14929 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Mozilla\WINWORD.exe - 853d17ca92bc9bed3fab715fdecd6ae21cb4d09a52e3d53ff3121d37abc7962a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://i.assmio.com/1CE986AF8C3E4CB9000014FB15284C8F.aspx
http://i.assmio.com/1D49E6AC8C3E4EAA00001C7BB024FEE0.html
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://i.assmio.com/1DB706A78C3E508D000023EA573F4A6B.shtm
http://i.assmio.com/5D0996A08BDE2D7D0000264C1F7EEE4E.shtm
http://i.assmio.com/5D4DD6AB8BDE2ECA00002B48FE0B7DAC.506I
http://i.assmio.com/5D6FB6A98BDE2F5D00002DA7D5093CDA.aspx
http://i.assmio.com/5DAAF6AD8BDE30A4000032B7B406CC39.html

Embedded domains

i.assmio.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.113
4.230.171.124
40.84.97.4
20.42.179.192
74.178.76.128
20.247.184.197
20.165.94.54
20.42.73.25
104.18.33.89
92.223.78.30
162.159.142.9
52.110.12.28
4.150.223.104
4.150.223.102
172.233.212.129
52.148.114.188
72.153.5.132
52.110.12.24
52.110.12.21

More Juko samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report