MALICIOUS — 678_VolatileCedar.Explosion.bin

MALICIOUS — 678_VolatileCedar.Explosion.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Explosive family. 9 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: e2e6ed82703de21eb4c5885730ba3db42f3ddda8b94beb2ee0c3af61bc435747
SHA-1: 0da0331e07bb33f6091fc6e1ff0061a00cf88887
MD5: eb7042ad32f41c0e577b5b504c7558ea
imphash: c2f85e88a5cb443284b07bcb1de0dcdd
ssdeep: 6144:pn/4o9pZTVIWtaToZ7MIwTosXkJQJ5MtxWzsIWZSh56LHZQ:pAofrLZ7MIwTosGxWxWwG6
TLSH: T1E1489E491E27AA46E2EB9B404D516E0E94B77CE371BF298C17C6D44F268748F634093C
Submitted as: 678_VolatileCedar.Explosion.bin
File type: pe · Size: 357339 bytes
Verdict: malicious (100/100) · Family: Explosive

Detections (9 of 52 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Explosive-6479674-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
Cyble Vision: Cyble Vision: Explosive
Microsoft Defender: Worm:Win32/Hokobot.A!dha
Emsisoft (Emergency Kit): Gen:Variant.Bulz.347719
Trellix Stinger (McAfee): Generic.dgg
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Explosive-6479674-0 (rule Win.Trojan.Explosive-6479674-0) - engine signal, weight 0.90, confidence 0.95
Cyble Vision flagged Cyble Vision: Explosive (rule Cyble Vision: Explosive) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Worm:Win32/Hokobot.A!dha (rule Worm:Win32/Hokobot.A!dha) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Bulz.347719 (rule Gen:Variant.Bulz.347719) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Generic.dgg (rule Generic.dgg) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (windows)

2923 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/6343/files/b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209 - b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

Embedded URLs

http://www.microsoft.com/en-us/default.aspx

Embedded domains

www.microsoft.com
inference.location.live.net
aefd.nelreports.net
maktoob.yahoo.com

Embedded IP addresses

162.159.36.2

Registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

More Explosive samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report