MALICIOUS — e4b72bb6e5b46976c1f8dd42993e566aff595e3014127115520560390867ae54

MALICIOUS — e4b72bb6e5b46976c1f8dd42993e566aff595e3014127115520560390867ae54 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Juko family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: e4b72bb6e5b46976c1f8dd42993e566aff595e3014127115520560390867ae54
SHA-1: a82be83eaf7e1afb7b24ea34d1dd77fc23569c38
MD5: 32c31d5f4d94c34e8352dbeb6b0e721d
imphash: 170193414cc4abf0ae27dc2a19d74879
ssdeep: 768:qZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqKNPWQHp9:OLsF2Kerc64sTiX2IV0Dhu9
TLSH: T1072F396647309602F391A78B55403F4DB0B6A8EE3136C7519EE2B57E8BE045738B847C
Submitted as: e4b72bb6e5b46976c1f8dd42993e566aff595e3014127115520560390867ae54
File type: pe · Size: 32788 bytes
Verdict: malicious (100/100) · Family: Juko

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Juko-9753236-0
Microsoft Defender: Trojan:Win32/SelfDel!pz
Emsisoft (Emergency Kit): Trojan.Downloader.JUKO
Kaspersky (KVRT): HEUR:Trojan.Win32.SelfDel.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Juko-9753236-0 (rule Win.Malware.Juko-9753236-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/SelfDel!pz (rule Trojan:Win32/SelfDel!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Downloader.JUKO (rule Trojan.Downloader.JUKO) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.SelfDel.gen (rule HEUR:Trojan.Win32.SelfDel.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 31 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

14562 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Mozilla\WINWORD.exe - af8dd231f26cc38f5c881d6c8683988d702469bec80e8cbc90bc0d255201aa3b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://i.assmio.com/5A06D6AB8AEE6BFE0000118A653E9DE2.aspx
http://i.assmio.com/5A7D26A98AEE6DEF000018FF9845069F.html
http://i.assmio.com/5ADA46AB8AEE6FCF000020683F4D5218.shtm
http://i.assmio.com/5B18F6AD8AEE713B000025FD4C6D8E30.html
http://i.assmio.com/1A6886AF8A814DDC000027CCE6726392.056B
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://i.assmio.com/1AB406A78A814F3D00002D6C0314A269.shtm
http://i.assmio.com/1AC5A6A88A814FBC00002F3B7E73AC04.846Q

Embedded domains

i.assmio.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.169
52.123.252.241
40.84.85.40
4.230.171.124
52.230.59.222
74.178.240.51
4.150.223.111
135.233.95.144
74.178.240.61
51.116.253.169
4.150.223.103
172.237.146.49
4.247.188.224
135.234.160.246
52.148.114.188
52.110.12.22
72.145.35.98
52.110.12.50

More Juko samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report