MALICIOUS — de4f52750af206bb8971f18e9306888c643d1fc0ec5d2b5f473aaf3055e52cd0

MALICIOUS — de4f52750af206bb8971f18e9306888c643d1fc0ec5d2b5f473aaf3055e52cd0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Juko family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: de4f52750af206bb8971f18e9306888c643d1fc0ec5d2b5f473aaf3055e52cd0
SHA-1: f0581a3a86a0de84ee456b395dc19977cd4d66f8
MD5: 43ab534ba901234a3f45aeb10c680042
imphash: 170193414cc4abf0ae27dc2a19d74879
ssdeep: 768:qZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqKNPWQHpD:OLsF2Kerc64sTiX2IV0DhuD
TLSH: T14C2F396647309602F391A68B55403F4DB0B6A9EE3136C7518EE2B57E8BE045738B847C
Submitted as: de4f52750af206bb8971f18e9306888c643d1fc0ec5d2b5f473aaf3055e52cd0
File type: pe · Size: 32780 bytes
Verdict: malicious (100/100) · Family: Juko

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Juko-9753236-0
Microsoft Defender: Trojan:Win32/SelfDel!pz
Emsisoft (Emergency Kit): Trojan.Downloader.JUKO
Kaspersky (KVRT): HEUR:Trojan.Win32.SelfDel.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Juko-9753236-0 (rule Win.Malware.Juko-9753236-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/SelfDel!pz (rule Trojan:Win32/SelfDel!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Downloader.JUKO (rule Trojan.Downloader.JUKO) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.SelfDel.gen (rule HEUR:Trojan.Win32.SelfDel.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 29 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

14714 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Mozilla\WINWORD.exe - 2ecc2122928a8da0a7fdee9eb5c92ae33737d59f9e42e5284d8957f5659cd57f

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://i.assmio.com/2259A6A88ED10CE8000017FEAA57536E.448A
http://i.assmio.com/22C706A78ED10ED900001F8F456F05C8.aspx
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://i.assmio.com/232726A98ED110B3000026EDFC6F5481.html
http://i.assmio.com/628056AC8E63EDDD0000276FBC49D963.html
http://i.assmio.com/62ED06A78E63EF9400002E5C933F8B4E.shtm
http://i.assmio.com/62ED66AD8E63EFBD00002EDB635E24B8.shtm

Embedded domains

i.assmio.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.1
40.84.97.4
52.123.252.248
4.230.171.124
40.84.85.40
74.178.240.51
51.104.15.252
74.178.240.61
4.144.132.114
172.64.154.167
135.233.95.144
172.233.212.151
52.110.12.10
52.110.12.15
72.145.35.102
52.148.114.188
52.110.12.47
52.110.12.37

More Juko samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report