MALICIOUS — 43e5dc222d98f4cdcb5a394cbdf27423d6a164ca897dbc8c46229fdac33d5d6a

MALICIOUS — 43e5dc222d98f4cdcb5a394cbdf27423d6a164ca897dbc8c46229fdac33d5d6a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Nupik family. 7 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 43e5dc222d98f4cdcb5a394cbdf27423d6a164ca897dbc8c46229fdac33d5d6a
SHA-1: d9d781abc4d3c7d24939e9f4a9175dc458501122
MD5: b8c929426bcb224a840c9f9105d73dfa
imphash: 532816589b7c9c3bed0fbcc3d1503ba1
ssdeep: 12288:TNodBiTI+TpCA6EZO7KUQRZ66z24VZbdrpgrXN2LWzmidN:ZoPD+TpC3vKU6Z66z24VZbFpgJ2LWzm
TLSH: T1634B295DCA22A281D06286706CC2DDFD60113AE573A8988F7133F0FD76FB917995029E
Submitted as: 43e5dc222d98f4cdcb5a394cbdf27423d6a164ca897dbc8c46229fdac33d5d6a
File type: pe · Size: 484672 bytes
Verdict: malicious (100/100) · Family: Nupik

Detections (7 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Worm.Nupik-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: Worm:Win32/Delf.BE!MTB
Emsisoft (Emergency Kit): Dropped:Generic.Malware.SV!p2p!u34.AB9A06E4
Kaspersky (KVRT): P2P-Worm.Win32.VB.dz

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Worm.Nupik-1 (rule Win.Worm.Nupik-1) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload: BalROK.HTML - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 22 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: 3.6.1.0, 5.0.3.6 - static signal, weight 0.35, confidence 0.60
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

369 behavior events · 1 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Windows\SHARE_TEMP\Icon12.ico - 67bc1cd876f5059789b0dc8dc16c0b2155e55aca8d1c8439d70c8882e1875740
C:\BalROK.HTML - 3959c5532031a58119c317dda15ac9313505df4a92c004cd2e76b071b0fad4a4
C:\Windows\SHARE_TEMP\Icon6.ico - 0df5c718b7aee9f045f804f6a53cb0727f66e1ac1df612c6ecf342aed81ce130
C:\Windows\SHARE_TEMP\Icon2.ico - 00a339ff5338d0cfe91b262175eef4e5fd07f9d28e8f980a1f5ff43a5a81e597
C:\Windows\bugMAKER.bat - acb4b330d943017cb1b0a28daa97896e391d4a804f6294223084cb676d68a508
C:\Windows\SHARE_TEMP\Icon7.ico - 71acc5a88debfdba0eed23272ef4b09fd6609eeb4b1ec457c72444472ad8b3a4
C:\Windows\winhash_up.exe - cae9e5bc4b000d7ff6f319afb3adf5e200ed716ba66eb18c79d85434dbb86fa1
C:\Windows\SHARE_TEMP\Icon3.ico - d2770f68db717c5335ceca3f2b0be1e294839a4904d3525f4c5e9847654d39c2
C:\Windows\SHARE_TEMP\Icon14.ico - adb0b5eb4fcfcc55c40eaa2ba3d142ed413293b2212bb2a1ddd8ed062db004bf
C:\Windows\SHARE_TEMP\Icon10.ico - 76f05dd79b2d3a08baf928e4811b0f179e96ac351ff8007f2e24f5fbb4b95253
C:\Windows\SHARE_TEMP\Icon5.ico - 462d333fc849166df8cb4e9ba6edd8404f4d79ebcd535125ecb5e8fe9d2cc0e0

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787937690&P2=404&P3=2&P4=Yn%2bNcoSWyGI3r%2fHEsNnaDLey6SlTcC3%2fDsQXUK5tN5rCVW4XtkkemgjSj6kcOSj97gXWoYKgPLGZ%2b7dRGKsb0g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

3.6.1.0
5.0.3.6
20.42.179.192
20.184.175.0
57.155.101.212
20.247.185.124
4.230.171.124
20.165.94.63
20.165.94.54
20.42.65.89
52.123.128.14
20.76.201.171
40.99.134.18
20.42.65.88
52.123.252.192
40.84.97.4
135.233.45.221
172.178.240.161
20.209.154.161
203.26.79.13
52.148.114.188
20.165.94.46
72.154.7.104
52.110.12.22

File paths

C:\Programme\eMule
V:\:a:f:k:p:v:~:

More Nupik samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report