MALICIOUS — c8d63cd734a3f4450672e9843d72f6bc25a9d4c059a4bf9996d2b2308199730f

MALICIOUS — c8d63cd734a3f4450672e9843d72f6bc25a9d4c059a4bf9996d2b2308199730f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Juko family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: c8d63cd734a3f4450672e9843d72f6bc25a9d4c059a4bf9996d2b2308199730f
SHA-1: a25a97fead024d7ba8dd3027025b9d3e1e2e4e29
MD5: efb5067b4f0d7e1e7759b97eb951cc05
imphash: 170193414cc4abf0ae27dc2a19d74879
ssdeep: 768:qZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqKNPWQHpF:OLsF2Kerc64sTiX2IV0DhuF
TLSH: T19C2F396647309602F391A68B55403F4DB0B6A8EE3136C7519EE2B67E8BE045738B847C
Submitted as: c8d63cd734a3f4450672e9843d72f6bc25a9d4c059a4bf9996d2b2308199730f
File type: pe · Size: 32776 bytes
Verdict: malicious (100/100) · Family: Juko

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Juko-9753236-0
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Trojan.Downloader.JUKO
Kaspersky (KVRT): HEUR:Trojan.Win32.SelfDel.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Juko-9753236-0 (rule Win.Malware.Juko-9753236-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Downloader.JUKO (rule Trojan.Downloader.JUKO) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.SelfDel.gen (rule HEUR:Trojan.Win32.SelfDel.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 31 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

17191 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Mozilla\WINWORD.exe - c91c643a5c814ab243801359087c3771d685acd0c1c636c9b1b513cb767c73b8

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://i.assmio.com/3490C6AA8A1A74CE00000F9F9250AF18.810L
http://i.assmio.com/350816A88A1A76BF0000172A5C6E6ADB.html
http://i.assmio.com/356E36AA8A1A789800001E9F0369B65D.shtm
http://i.assmio.com/35CB26A98A1A7A6E000025A86A5CEEEF.228S
http://i.assmio.com/35CB86AF8A1A7A80000025FDAA790279.812H
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://i.assmio.com/754066AD89B3582F00002D173137239E.aspx
http://i.assmio.com/754096A089B3583000002D6C514A2FFE.aspx

Embedded domains

i.assmio.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.9
4.144.132.114
52.123.252.197
4.230.171.124
52.110.12.22
52.110.12.37
172.233.212.90
135.233.45.221
20.42.179.204
57.150.192.97
57.155.104.224
135.233.45.222
52.148.114.188
51.104.15.252
72.154.7.112
172.172.255.218
52.110.12.1
52.110.12.21

More Juko samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report