MALICIOUS — 655_VolatileCedar.Explosion.bin

MALICIOUS — 655_VolatileCedar.Explosion.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Explosive family. 6 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: b275c8978d18832bd3da9975d0f43cbc90e09a99718f4efaf1be7b43db46cf95
• SHA-1: 804e4fb9aa66eb3aad967e485f0273f3936c6a24
• MD5: c19e91a91a2fa55e869c42a70da9a506
• imphash: 215cfba74842885f74be929aa908eaba
• ssdeep: 1536:HKYtidWRWFcB7bttSVHM0OraO73bHb6usR3J/GFNneDqnVjrI9Yo8ZmPkhMGlYjO:HvqIZhtsHM0iuEHVw98ZqglYjO
• TLSH: T1563DBE080407E341F3B7CE804C94DD0ED1A1E5EB75BE66682AD7C10F4AE78B7A62652D
• Submitted as: 655_VolatileCedar.Explosion.bin
• File type: pe · Size: 123410 bytes
• Verdict: malicious (99/100) · Family: Explosive

Detections (6 of 52 engines)

• ClamAV (daily): Win.Trojan.Explosive-6538489-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win32/Hokobot.B!dha
• Emsisoft (Emergency Kit): Gen:Variant.Zusy.135184
• Trellix Stinger (McAfee): Generic.dgg
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1071.001

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Explosive-6538489-0 (rule Win.Trojan.Explosive-6538489-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Hokobot.B!dha (rule Trojan:Win32/Hokobot.B!dha) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Zusy.135184 (rule Gen:Variant.Zusy.135184) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Generic.dgg (rule Generic.dgg) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://maktoob.yahoo.com/, http://www.bing.com/default.aspx - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• http://maktoob.yahoo.com/
• http://www.bing.com/default.aspx
• http://www.google.com/
• http://www.microsoft.com/en-us/default.aspx

Embedded domains

• maktoob.yahoo.com
• www.bing.com
• www.google.com
• www.microsoft.com

More Explosive samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report