MALICIOUS — 664_VolatileCedar.Explosion.bin

MALICIOUS — 664_VolatileCedar.Explosion.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Explosive family. 8 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: bd039bb73f297062ab65f695dd6defafd146f6f233c451e5ac967a720b41fc14
• SHA-1: 008bb270dbdccc8da97baf49c9d091a38aba6ff1
• MD5: 5b505d0286378efcca4df38ed4a26c90
• imphash: 6d15f71fb17ccee37bd05ca01e7a78ef
• ssdeep: 1536:M/gXm4ZNWBG8ehzYmXkdRtExJm2ifjHOQEqMN7a9HaMiBYn5QSGlbXgR8:agXm4f86UocIxnTsQ1lbXgR8
• TLSH: T1C43B8D520537AB44F3E2C790AC429D1E80E1F4EB657E64DC06E7C57F5EB68A310A81E8
• Submitted as: 664_VolatileCedar.Explosion.bin
• File type: pe · Size: 106496 bytes
• Verdict: malicious (99/100) · Family: Explosive

Detections (8 of 52 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Trojan.Explosive-6538491-1
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
• Microsoft Defender: Trojan:Win32/Hokobot.A.dll!dha
• Emsisoft (Emergency Kit): Gen:Variant.Barys.326790
• Trellix Stinger (McAfee): Generic.dgg

MITRE ATT&CK

• T1547.001
• T1057
• T1056.001
• T1112

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Explosive-6538491-1 (rule Win.Trojan.Explosive-6538491-1) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 5 finding(s), e.g. RWX/private injected region in WebExperienceH (pid 6332) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

112 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Registry keys

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

File paths

• d:\vb_c++\Explosive\ExplosiveTr\4-2013\tools-
• U:\:d:j:r:x:

More Explosive samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report