MALICIOUS — 45630e9aa3ad07a42bf90702f458f855c5d64cdc82648cb01dc686eb62d44bee

MALICIOUS — 45630e9aa3ad07a42bf90702f458f855c5d64cdc82648cb01dc686eb62d44bee is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the NabucurObfs family. 4 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 45630e9aa3ad07a42bf90702f458f855c5d64cdc82648cb01dc686eb62d44bee
SHA-1: 3cb606edf7ab766ad3656be2f18091014581f738
MD5: d8c893b96d07d5d46a4f721a4ee94bd5
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 24576:FapC+/JQ+KAFxyalsUYDD0JHq+wgpMAwsy:jUYQHq+wmOsy
TLSH: T1EB58445D8B8CBFAD5B6E7C1B0447BA61A09C3F2DFA886B59160D308B93D9C100DE9453
Submitted as: 45630e9aa3ad07a42bf90702f458f855c5d64cdc82648cb01dc686eb62d44bee
File type: pe · Size: 1665536 bytes
Verdict: malicious (99/100) · Family: NabucurObfs

Detections (4 of 25 engines)

Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Dropped a malicious payload (NabucurObfs): b789131bd8dcacea92bb2339109a96ae147d13e4fe4d812643524cfd55e84b10 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 41 external host(s) at runtime (12 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

31668 behavior events · 2 ATT&CK techniques · 17 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8776/files/b789131bd8dcacea92bb2339109a96ae147d13e4fe4d812643524cfd55e84b10 - b789131bd8dcacea92bb2339109a96ae147d13e4fe4d812643524cfd55e84b10
/opt/CAPEv2/storage/analyses/8776/files/543349ecdf5777325064163a2b6b147dbc3b1317df5c2b02adc5f601442da6f2 - 543349ecdf5777325064163a2b6b147dbc3b1317df5c2b02adc5f601442da6f2
/opt/CAPEv2/storage/analyses/8776/files/11be0165e2be3f977861196249ab976322cc7cc24fe2bf1f77df0aa11b3b4def - 11be0165e2be3f977861196249ab976322cc7cc24fe2bf1f77df0aa11b3b4def
/opt/CAPEv2/storage/analyses/8776/files/aed90fdbff14fb45b856f43fe19b9c23e71d7d93a7fb4f9499ebde0504850c40 - aed90fdbff14fb45b856f43fe19b9c23e71d7d93a7fb4f9499ebde0504850c40
/opt/CAPEv2/storage/analyses/8776/files/a385184ad55ad884ae66e05d2fce31638e37cda1622e32e603cf759794d86910 - a385184ad55ad884ae66e05d2fce31638e37cda1622e32e603cf759794d86910
/opt/CAPEv2/storage/analyses/8776/files/7dac19351609f351a1ef9afd1221b8d9d403edc0d058e3aee50843d5c4350a6d - 7dac19351609f351a1ef9afd1221b8d9d403edc0d058e3aee50843d5c4350a6d
/opt/CAPEv2/storage/analyses/8776/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
/opt/CAPEv2/storage/analyses/8776/files/bec12d124a76269b47a6a7f62c926a91e994e2001f2eba7e079494518b69f6c5 - bec12d124a76269b47a6a7f62c926a91e994e2001f2eba7e079494518b69f6c5
/opt/CAPEv2/storage/analyses/8776/files/d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698 - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
/opt/CAPEv2/storage/analyses/8776/files/80d2a97b711cfc7a5f99da7cff2e4deffe33ab7da9fdb1f4357c9d81a1db50ca - 80d2a97b711cfc7a5f99da7cff2e4deffe33ab7da9fdb1f4357c9d81a1db50ca
/opt/CAPEv2/storage/analyses/8776/files/5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e - 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
/opt/CAPEv2/storage/analyses/8776/files/2bd7425e3c8ebfa1f8c83bb7e016357e52ff6db966551198e0cb1735a64715a8 - 2bd7425e3c8ebfa1f8c83bb7e016357e52ff6db966551198e0cb1735a64715a8
/opt/CAPEv2/storage/analyses/8776/files/0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca - 0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca
/opt/CAPEv2/storage/analyses/8776/files/609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a - 609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a
/opt/CAPEv2/storage/analyses/8776/files/1983d7fa1c94b2eba89192bbc67f2c79610899112836e67ab0f04e72258d8a13 - 1983d7fa1c94b2eba89192bbc67f2c79610899112836e67ab0f04e72258d8a13

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://google.com/
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786360256&P2=404&P3=2&P4=gEKOPXrk701pYN5WparBxJjcoOY3lIFHDVz7dPvza9x1zyyN5XmAiX7hqougRinX%2bXM8TVAGfT8bs81PDlvXdQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

142.250.195.142
20.42.65.91
52.123.252.248
52.230.59.222
85.210.193.152
4.230.171.124
74.178.76.128
20.42.65.88
172.178.240.163
74.178.76.54
92.223.78.30
200.87.164.69
20.52.64.201
200.119.204.12
52.123.252.218
203.26.79.13
190.186.45.170
4.150.223.107
52.168.117.168
52.123.252.192
74.179.71.159
4.243.160.20
52.148.114.188
40.84.85.40
52.110.12.52

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report