MALICIOUS — 81392777526cea6563a0c29a4162ede80d163a6b951fadb77601626e056babd4

MALICIOUS — 81392777526cea6563a0c29a4162ede80d163a6b951fadb77601626e056babd4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the NabucurObfs family. 5 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 81392777526cea6563a0c29a4162ede80d163a6b951fadb77601626e056babd4
SHA-1: af98c77aa314deeed56818ca594ad59f9dbf610d
MD5: b8331c8e96918d67adecba1c60a0b791
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 24576:V5gHQQQOYQ3fW+uBvxS3gh2Iq9/dlUK3UJh0XPj6447rnQGMjeJg+sXeM8M+kuV0:VmG6CiuM8Mhy+3DvMKcYUa
TLSH: T1325834D5887AA18F8CD92908687881EC26B8D5D065BB2B1CE1DE13DCD1D7BF1C788E05
Submitted as: 81392777526cea6563a0c29a4162ede80d163a6b951fadb77601626e056babd4
File type: pe · Size: 1765376 bytes
Verdict: malicious (100/100) · Family: NabucurObfs

Detections (5 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7948) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.PolyRansom.a (rule Virus.Win32.PolyRansom.a) - engine signal, weight 0.55, confidence 0.85
Dropped a suspicious payload: f275b06a72d9c6aabc8cd4ac02fe019936cdc739aa5e5bf6d7ff6ce597dfd88a - dynamic signal, weight 0.50, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 38 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

33418 behavior events · 2 ATT&CK techniques · 18 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8803/files/f275b06a72d9c6aabc8cd4ac02fe019936cdc739aa5e5bf6d7ff6ce597dfd88a - f275b06a72d9c6aabc8cd4ac02fe019936cdc739aa5e5bf6d7ff6ce597dfd88a
/opt/CAPEv2/storage/analyses/8803/files/05a37477397159185db69b6651d659ffa98f47b73691c7d304bdae3be0a14c38 - 05a37477397159185db69b6651d659ffa98f47b73691c7d304bdae3be0a14c38
/opt/CAPEv2/storage/analyses/8803/files/4c4b0ac6c66e5018aa0561b96adbe1456dbf6b4fa7e0ba55e307de683b5269f1 - 4c4b0ac6c66e5018aa0561b96adbe1456dbf6b4fa7e0ba55e307de683b5269f1
/opt/CAPEv2/storage/analyses/8803/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
/opt/CAPEv2/storage/analyses/8803/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
/opt/CAPEv2/storage/analyses/8803/files/d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698 - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
/opt/CAPEv2/storage/analyses/8803/files/ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51 - ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
/opt/CAPEv2/storage/analyses/8803/files/72c4aef1605de1475fdfe1ab8a4ef9f7b55be2e58a66da73c384bcf1259d1e43 - 72c4aef1605de1475fdfe1ab8a4ef9f7b55be2e58a66da73c384bcf1259d1e43
/opt/CAPEv2/storage/analyses/8803/files/5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e - 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
/opt/CAPEv2/storage/analyses/8803/files/bef2865dd2443ad69416cb4ce66151dbd042a1e7ed0ac04f804f6b6a0833a085 - bef2865dd2443ad69416cb4ce66151dbd042a1e7ed0ac04f804f6b6a0833a085
/opt/CAPEv2/storage/analyses/8803/files/0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca - 0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca
/opt/CAPEv2/storage/analyses/8803/files/0c5436571b2b4edcc56f8b3b5184fb65a7dfdc238db5c2c44970f83594cf3be4 - 0c5436571b2b4edcc56f8b3b5184fb65a7dfdc238db5c2c44970f83594cf3be4
/opt/CAPEv2/storage/analyses/8803/files/1681f82ecb5235f33f3dc199341a906ea2c50018b1245e49a3b01cdff57b5473 - 1681f82ecb5235f33f3dc199341a906ea2c50018b1245e49a3b01cdff57b5473
/opt/CAPEv2/storage/analyses/8803/files/609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a - 609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a
/opt/CAPEv2/storage/analyses/8803/files/e67e1b842e0701ec554c8956df4a39b4723a9412eed5c1b0b4dd110cd419e2f7 - e67e1b842e0701ec554c8956df4a39b4723a9412eed5c1b0b4dd110cd419e2f7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://google.com/
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786361815&P2=404&P3=2&P4=DBgATlDJ1Hgq3f7RnMKgQCpubSFi%2fvzgvj%2fQ4iDvAUduQAnyOghQZ%2b7gjY2m0F8wP%2bJmmqSM%2fuDb6mkbWbRvfw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786361939&P2=404&P3=2&P4=a%2fCHX7XDSNhKArRL3ie9DWRtDBuegiL8M8CpcJKMJCEnyibGXmIR1bmHkBxSz%2fIpu2aLGoBVQsVf1E8HNkPBTA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.13
4.247.188.224
4.230.171.124
48.211.4.16
4.144.132.223
20.165.94.63
135.233.95.135
20.184.175.23
135.233.45.223
200.87.164.69
172.178.240.163
203.26.79.13
200.119.204.12
190.186.45.170
20.165.94.46
72.145.35.116
52.148.114.188
20.42.65.90
52.168.117.169
142.251.222.238
135.233.95.80
52.110.12.38
52.110.12.53

File paths

N:\a-

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report