MALICIOUS — virussign.com_6c3989ed712f7a2667e61a13b8ecb010.vir

MALICIOUS — virussign.com_6c3989ed712f7a2667e61a13b8ecb010.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the NabucurObfs family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 207a661c064f906135ceeed670e82b700ea4133b3e49315c66e3df19d0dfefeb
SHA-1: 38df785b57601b626859c78a3edfcb1283e3e47f
MD5: 6c3989ed712f7a2667e61a13b8ecb010
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 98304:feAUY6fTgjwnsVIpu90Zx/ukIfoYhJY/1P2mhblsv7UpNDGl/inE3pW3Q16C:GRfMknsVIpu90Zx/ukIfoYhJY/1P2mhs
TLSH: T1C762C368FDA6F47C66838C0B0394440DA484067CAEE777157B9472ED93CEA0A8D7CB85
Submitted as: virussign.com_6c3989ed712f7a2667e61a13b8ecb010.vir
File type: pe · Size: 4204032 bytes
Verdict: malicious (100/100) · Family: NabucurObfs

Source: VirusSign · first seen 2026-08-20T00:00:00.000Z · SHA-256 verified

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): BC.Win.Virus.Ransom-9157.B
Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.B (rule BC.Win.Virus.Ransom-9157.B) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 4 finding(s), e.g. RWX/private injected region in vcIYEIkQ.exe (pid 8516) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dropped 26 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

81704 behavior events · 3 ATT&CK techniques · 56 dropped files.

Dropped files

bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\ProgramData\Optimizer\ReadyMadeMenus\RemoveTakeOwnership.reg - 177fb8f30d10e50115500d1b2af488a9d885fba42c2fb22e6fbbee337806af19
C:\ProgramData\Optimizer\Required\EnableOfficeTelemetryTasks.reg - 6a8f76c97fd957afec1f416363df1e56843c8a56e0f2c470aae66d9be8cd2a1a
C:\ProgramData\JaMUMgQE\TWkkwsMw.exe - c07d74490cde5523c5434e8cd0eecb49b018fa43668560dd67e67b7d351288da
C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.exe - 8c6c1caadea4beac3a4d0aa581a0fb90fc4fa60357393377d4ea1701aeb29dd8
C:\Users\analyst\AppData\Local\Temp\MUAO.exe - bc5142bc382efe4e66c952eb1113a900ac1730898fa65cc218b96ce207f4cfc3
C:\Users\analyst\rSwIoccE\vcIYEIkQ.exe - 0d52ed461bb25394afcb24f6d2b436edf1f4f1c547c4d00ed3eec994e0180584
C:\ProgramData\Optimizer\ReadyMadeMenus\SystemShortcuts.reg - 02c4c6610f2baa98cef5005a2155a76dd5d52b9b2c8bb49cb31e1a1ef5b74b9a
C:\ProgramData\Optimizer\ReadyMadeMenus\DesktopShortcuts.reg - 52b190cd52671ba5652afe574245d72dd91ad0ec4168ea405eecc90bf6365bea
C:\ProgramData\xiocAsMc\yKgEskQE.exe - 5ba15a5ccb4c99c42d8290411fe29b8e00706f88c04a481e9d149156431ab713
C:\ProgramData\Optimizer\Required\AddOpenWithCMD.reg - cc86ff6b43e0216a693f9ed45369b574126bd6a874d889774bbb3eda4222e061
C:\ProgramData\Optimizer\Required\GPEditEnablerInHome.bat - 10a85a8f7e9b6e118ed1ad73be6c15777f53e88542d301088a8d6cf81bfdccad
C:\ProgramData\Optimizer\Required\RestoreClassicPhotoViewer.reg - c44fe1f158db74cc7db7d54303ae65a6497a60b3a44bfcfc67f13a3a540039cd
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.exe - d6c19f013f913804423b28ed2392f88bba292bc231ca568c80ae900a7c87b4f3
C:\ProgramData\Microsoft\User Account Pictures\guest.bmp - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://google.com/
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787849303&P2=404&P3=2&P4=A9O1i9EBmjSq7mE88nrygVOs%2f350QcMnUz3CrdXejDzc%2bMTy1be3ubVG1OMzNV4%2b8vqK3X87Yf%2fzdt%2bdUco0eQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787849419&P2=404&P3=2&P4=TOqetycSE65MgRHrt0eD7aDXIHDPnwygktvMaTqCY05kduCObX62F%2fqAIrvQ2TDSGZBuwyTDkyNRDdHeI42heg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

104.46.162.224
52.123.252.233
20.42.179.192
4.230.171.124
57.154.63.210
4.144.132.223
135.232.92.137
74.178.76.54
4.207.44.76
20.165.94.63
20.236.44.162
52.123.129.14
4.150.223.99
135.233.45.221
200.87.164.69
203.26.79.13
200.119.204.12
40.74.98.199
4.150.223.113
52.148.114.188
190.186.45.170
135.232.92.34
72.153.5.139
52.110.12.21
52.110.12.1

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report