MALICIOUS — 3bb85eaef7b440a5f2bfa0b60fbafd0e3501c57a5b7105fe97f1282c12fbdafe

MALICIOUS — 3bb85eaef7b440a5f2bfa0b60fbafd0e3501c57a5b7105fe97f1282c12fbdafe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the NabucurObfs family. 4 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 3bb85eaef7b440a5f2bfa0b60fbafd0e3501c57a5b7105fe97f1282c12fbdafe
SHA-1: f279cd29286b9c9c35b1767721439d84dfdaf2fa
MD5: ce65eb12b6a5529919a350a8c62b4725
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 24576:G+yV3qBUp5e8aFbh4JJSm3+5GpDQ8jllEmB:G+yZqxpFbh42m3LpDQmY6
TLSH: T1795A652E1F144EC5855B9D58ABFB7CAC9C42C18CA5601DA85C9FAF323C0DB2748D17A2
Submitted as: 3bb85eaef7b440a5f2bfa0b60fbafd0e3501c57a5b7105fe97f1282c12fbdafe
File type: pe · Size: 2037760 bytes
Verdict: malicious (97/100) · Family: NabucurObfs

Detections (4 of 25 engines)

Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 8 weighted signals:

Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 35 external host(s) at runtime (12 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

28907 behavior events · 2 ATT&CK techniques · 18 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8763/files/bc572e24665547edb2eeda02b7bd27cb760ad08a23af0581ffa5d68f79423416 - bc572e24665547edb2eeda02b7bd27cb760ad08a23af0581ffa5d68f79423416
/opt/CAPEv2/storage/analyses/8763/files/5c4bf235a24a4112a5e73ff3d08bc2b70b73eca20c0d892a53eac495df0a1ec9 - 5c4bf235a24a4112a5e73ff3d08bc2b70b73eca20c0d892a53eac495df0a1ec9
/opt/CAPEv2/storage/analyses/8763/files/74e3e3a0d198e52bea0fec23d1c11d6297dba9f9179408f2c466955f6cde5f53 - 74e3e3a0d198e52bea0fec23d1c11d6297dba9f9179408f2c466955f6cde5f53
/opt/CAPEv2/storage/analyses/8763/files/2aafb3531254ec9ac1c5b0f3dcaef96fc579c837de5883892d515526765a0163 - 2aafb3531254ec9ac1c5b0f3dcaef96fc579c837de5883892d515526765a0163
/opt/CAPEv2/storage/analyses/8763/files/2033e6ea70453487fa1a9fba3229598012ffee01121dde5824f08dccb3e6b96e - 2033e6ea70453487fa1a9fba3229598012ffee01121dde5824f08dccb3e6b96e
/opt/CAPEv2/storage/analyses/8763/files/2fca647599810c0a2b27e6b0857c8a84b0882c5cfed9c9a904aa0ca71692e202 - 2fca647599810c0a2b27e6b0857c8a84b0882c5cfed9c9a904aa0ca71692e202
/opt/CAPEv2/storage/analyses/8763/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
/opt/CAPEv2/storage/analyses/8763/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
/opt/CAPEv2/storage/analyses/8763/files/c4b54ca4c8975367a479005b3bc546da31ca8bd5aa35fd5309d4c6e80ab7f6c4 - c4b54ca4c8975367a479005b3bc546da31ca8bd5aa35fd5309d4c6e80ab7f6c4
/opt/CAPEv2/storage/analyses/8763/files/d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698 - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
/opt/CAPEv2/storage/analyses/8763/files/ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51 - ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
/opt/CAPEv2/storage/analyses/8763/files/09a1e9bd384f150edb3057357f47b38ebed049b6ae7101e3cbc0d309da5739d3 - 09a1e9bd384f150edb3057357f47b38ebed049b6ae7101e3cbc0d309da5739d3
/opt/CAPEv2/storage/analyses/8763/files/5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e - 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
/opt/CAPEv2/storage/analyses/8763/files/0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca - 0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca
/opt/CAPEv2/storage/analyses/8763/files/609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a - 609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://google.com/
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786359506&P2=404&P3=2&P4=ZOkrEKJ8F1kwJJMvoNuebXaAsf2zLDRnVxVC3HDAzBpnsQMAG7YVLTbx3ykTAJtYj5IwzSAAZZojpcOuT%2fuyHg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

142.250.207.14
52.168.117.174
4.230.171.124
4.247.188.233
74.178.240.61
20.247.185.124
20.184.175.4
74.178.240.51
135.233.45.222
200.87.164.69
172.178.240.161
200.119.204.12
203.26.79.13
190.186.45.170
85.210.196.11
74.178.76.44
72.153.5.129
52.148.114.188
142.250.195.238
52.110.12.38
52.110.12.15

File paths

l:\2M

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report