MALICIOUS — 058_Duqu2.bin
MALICIOUS — 058_Duqu2.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Duqu family. 5 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
c16410c49dc40a371be22773f420b7dd3cfd4d8205cf39909ad9a6f26f55718e - SHA-1:
f860acec9920bc009a1ad5991f3d5871c2613672 - MD5:
10e16e36fe459f6f2899a8cea1303f06 - imphash:
25097b4bacbce35beb1ad24027b8b014 - ssdeep:
384:vF5YD9564P2bUfolBd7P7KhkL/xbk3iDtRgd:Fa2ofolr7PekLlTtRg - TLSH:
T19B28E70757748FB1FBDA6EE0A8D3CD7E10B1EE65A83EA461C102C81E55E4D071932639 - Submitted as: 058_Duqu2.bin
- File type: pe · Size: 17408 bytes
- Verdict: malicious (99/100) · Family: Duqu
Detections (5 of 51 engines)
- ClamAV (daily): {MD5}bin.trojan.duqu.7903.UNOFFICIAL
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Trojan:Win32/Duqu!pz
- Emsisoft (Emergency Kit): Trojan.Duqu.E
- Trellix Stinger (McAfee): PWS-Duqu.b!10E16E36FE45
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 6 weighted signals:
- ClamAV (daily) flagged {MD5}bin.trojan.duqu.7903.UNOFFICIAL (rule
{MD5}bin.trojan.duqu.7903.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Duqu!pz (rule
Trojan:Win32/Duqu!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Duqu.E (rule
Trojan.Duqu.E) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged PWS-Duqu.b!10E16E36FE45 (rule
PWS-Duqu.b!10E16E36FE45) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
100 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- searchapp.bundleassets.example
- inference.location.live.net
- desktop-hsgcbep
- v10.events.data.microsoft.com
- config.edge.skype.com
- login.live.com
- settings-win.data.microsoft.com
- www.bing.com
- fd.api.iris.microsoft.com
- licensing.mp.microsoft.com
- windows.msn.com
- officeclient.microsoft.com
- watson.events.data.microsoft.com
- dns.msftncsi.com
- assets.msn.com
- 192.168.122.111
- 224.0.0.252
- 192.168.122.255
- 192.168.122.1
Embedded domains
- inference.location.live.net
More Duqu samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report