MALICIOUS — 6cb540f32c2e07dd2fb67b8c518611f94dafa683672604248edb960997b34e53

MALICIOUS — 6cb540f32c2e07dd2fb67b8c518611f94dafa683672604248edb960997b34e53 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the NabucurObfs family. 5 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 6cb540f32c2e07dd2fb67b8c518611f94dafa683672604248edb960997b34e53
SHA-1: 9b898608d0a0f76394bcdc421325fdf372c8c325
MD5: 0d7f61ff6b1efae67ebf500220009e5b
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 24576:rxQR6fqzwdhDgGlfnEYVvyYxbNqsKbSUAIgi9d+JIUl2:rxQ0yzsDgqnEYVvfxphK+UI0IJk
TLSH: T147580E05655E7092C5EC11FE3A352F894027058852EA43A2DD13D20D7FB8F37AE6A36B
Submitted as: 6cb540f32c2e07dd2fb67b8c518611f94dafa683672604248edb960997b34e53
File type: pe · Size: 1764864 bytes
Verdict: malicious (99/100) · Family: NabucurObfs

Detections (5 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

Dropped a malicious payload (NabucurObfs): df82efaf811e637e237b7eb4ba8c69d46bd5cbdde406eb4b3a8164c860b34164 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 50 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

44457 behavior events · 2 ATT&CK techniques · 39 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8736/files/df82efaf811e637e237b7eb4ba8c69d46bd5cbdde406eb4b3a8164c860b34164 - df82efaf811e637e237b7eb4ba8c69d46bd5cbdde406eb4b3a8164c860b34164
/opt/CAPEv2/storage/analyses/8736/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/8736/files/6ec0932b4dafb2382c70f4a459cd3a5998bee5fbdd38408e5efe8eb1c3f8d4b9 - 6ec0932b4dafb2382c70f4a459cd3a5998bee5fbdd38408e5efe8eb1c3f8d4b9
/opt/CAPEv2/storage/analyses/8736/files/45630e9aa3ad07a42bf90702f458f855c5d64cdc82648cb01dc686eb62d44bee - 45630e9aa3ad07a42bf90702f458f855c5d64cdc82648cb01dc686eb62d44bee
/opt/CAPEv2/storage/analyses/8736/files/6403dd8a976bfc40e1a3af22554e5f4a8ceecab4c6199e5516a46357dfd9e9b9 - 6403dd8a976bfc40e1a3af22554e5f4a8ceecab4c6199e5516a46357dfd9e9b9
/opt/CAPEv2/storage/analyses/8736/files/966dea4692455c6d18507050e7fb2d799d02563069befb9d27cc7ace958d8f90 - 966dea4692455c6d18507050e7fb2d799d02563069befb9d27cc7ace958d8f90
/opt/CAPEv2/storage/analyses/8736/files/c0356b5c5843e92bf320e0997a6f235fe8385f7938ae615ae13d5f991d8a5516 - c0356b5c5843e92bf320e0997a6f235fe8385f7938ae615ae13d5f991d8a5516
/opt/CAPEv2/storage/analyses/8736/files/5a4b6818c45bfe9ddc4af09e893b2e79a0aeb89672a455f112dd8c66c80567a9 - 5a4b6818c45bfe9ddc4af09e893b2e79a0aeb89672a455f112dd8c66c80567a9
/opt/CAPEv2/storage/analyses/8736/files/0fc9ccdc08a25c91a1f0dfaf776a8a273f893232b06511fafcaabfad16bafad7 - 0fc9ccdc08a25c91a1f0dfaf776a8a273f893232b06511fafcaabfad16bafad7
/opt/CAPEv2/storage/analyses/8736/files/b6b39c34f0eab42fc52110fc5435e7890341bff299eb18795bd481ef0ae2d3b3 - b6b39c34f0eab42fc52110fc5435e7890341bff299eb18795bd481ef0ae2d3b3
/opt/CAPEv2/storage/analyses/8736/files/56767e8f89c0a36bd7c6045bc7ff4e0440e7007859f0819246de2a013079943b - 56767e8f89c0a36bd7c6045bc7ff4e0440e7007859f0819246de2a013079943b
/opt/CAPEv2/storage/analyses/8736/files/d6a5b27cc8ec196f7ff7694ed78ed7b876109fdfdce336b2217cb88a58a3d081 - d6a5b27cc8ec196f7ff7694ed78ed7b876109fdfdce336b2217cb88a58a3d081
/opt/CAPEv2/storage/analyses/8736/files/3bb85eaef7b440a5f2bfa0b60fbafd0e3501c57a5b7105fe97f1282c12fbdafe - 3bb85eaef7b440a5f2bfa0b60fbafd0e3501c57a5b7105fe97f1282c12fbdafe
/opt/CAPEv2/storage/analyses/8736/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
/opt/CAPEv2/storage/analyses/8736/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786357900&P2=404&P3=2&P4=BCf5rciPAF%2blUkVuZ%2bUj73%2buSMwqeEsz6Mob739GTDx8whfAQqPznGsLcJyLC2HlFEq0SjRHyqzIKSIEhgWSLg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://google.com/
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786357964&P2=404&P3=2&P4=mmUle3hxm1g5nPDuuy9d%2b647XUSJk7LSlTK35x%2fEmBidgq5Brx6Q7lzCp%2foFvqWNLmh78Qnq8hP0jwQDF8%2fVFw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

oneclient.sfx.ms

Embedded IP addresses

40.79.167.10
52.123.252.247
4.230.171.124
57.155.101.212
20.247.184.197
135.232.92.34
135.232.92.137
135.232.92.97
4.150.223.112
203.26.79.13
20.42.65.88
135.234.160.247
200.87.164.69
135.234.160.245
200.119.204.12
190.186.45.170
72.145.35.111
52.148.114.188
85.210.193.152
52.168.117.174
4.207.44.73
52.123.252.242
4.247.188.233
4.247.188.224
57.154.63.210

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report