MALICIOUS — 83ad5f6038c2640b8d9ee72992da4e629480080b25dba8fbc18ea2425517b85c

MALICIOUS — 83ad5f6038c2640b8d9ee72992da4e629480080b25dba8fbc18ea2425517b85c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the NabucurObfs family. 4 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 83ad5f6038c2640b8d9ee72992da4e629480080b25dba8fbc18ea2425517b85c
SHA-1: 29febd81e3fb57375aeb528952781aabf57f6911
MD5: eedc78b542512bbf413a4b0d6b66864a
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 12288:S3j+Dm3KQXRQN5rB6N0oskkFbUmn5Nqv9aFXFYX5BXjz9nOMutFsxpeYwtmKPR:rI2bUB4VaVjZnOMCexsXtmc
TLSH: T12758FA613826E9BADD7D0CD64267E06E850DEF2010763EE6A64F4439943DEE34FB40A4
Submitted as: 83ad5f6038c2640b8d9ee72992da4e629480080b25dba8fbc18ea2425517b85c
File type: pe · Size: 1666048 bytes
Verdict: malicious (99/100) · Family: NabucurObfs

Detections (4 of 25 engines)

Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Dropped a malicious payload: bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 42 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

33055 behavior events · 2 ATT&CK techniques · 35 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8848/files/f6426edc01f422216045195cc118762625bbfe160554f78468d32c6cc1c63bd5 - f6426edc01f422216045195cc118762625bbfe160554f78468d32c6cc1c63bd5
/opt/CAPEv2/storage/analyses/8848/files/947b8421fde34ba193ba8aae5651acab322b6def286397bb963bb82c2c72e633 - 947b8421fde34ba193ba8aae5651acab322b6def286397bb963bb82c2c72e633
/opt/CAPEv2/storage/analyses/8848/files/894d6aa262c709e8367f1f5d59fbd3d77795518e7381ce1afafe93126a9a681f - 894d6aa262c709e8367f1f5d59fbd3d77795518e7381ce1afafe93126a9a681f
/opt/CAPEv2/storage/analyses/8848/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/8848/files/3d80fad2a0696d68a627d83ef268ed56debd4cb390d45e09bc90436b5dee569f - 3d80fad2a0696d68a627d83ef268ed56debd4cb390d45e09bc90436b5dee569f
/opt/CAPEv2/storage/analyses/8848/files/d0ef6037d107886278e693708899229edfc51b21e0ee639937528c9237b77d04 - d0ef6037d107886278e693708899229edfc51b21e0ee639937528c9237b77d04
/opt/CAPEv2/storage/analyses/8848/files/b09b6f1bea9128245cb9167255ece3f59a00f73c9dd264754edeabfdb8d395b9 - b09b6f1bea9128245cb9167255ece3f59a00f73c9dd264754edeabfdb8d395b9
/opt/CAPEv2/storage/analyses/8848/files/bbd53e5db7646420e1a342aa0da9d9cf2c875224881797fb059462a61d72ce42 - bbd53e5db7646420e1a342aa0da9d9cf2c875224881797fb059462a61d72ce42
/opt/CAPEv2/storage/analyses/8848/files/2f63cc444ab82ef17c5f16b3a9fb6d599c5dbc2240b34d25a977bcb488b5eb66 - 2f63cc444ab82ef17c5f16b3a9fb6d599c5dbc2240b34d25a977bcb488b5eb66
/opt/CAPEv2/storage/analyses/8848/files/e81660214be822cd54f8ec0c4efe6f788d997b746e557976c5c557775d8fe232 - e81660214be822cd54f8ec0c4efe6f788d997b746e557976c5c557775d8fe232
/opt/CAPEv2/storage/analyses/8848/files/9a11f5db8fdcf1412ae094591e98b9503c0ecf84e1d3e8e5eebb143085644f57 - 9a11f5db8fdcf1412ae094591e98b9503c0ecf84e1d3e8e5eebb143085644f57
/opt/CAPEv2/storage/analyses/8848/files/b437c4d3163fc5e7f3dc48257ee0bd59ad03243fb2411ff1943f10badef6386c - b437c4d3163fc5e7f3dc48257ee0bd59ad03243fb2411ff1943f10badef6386c
/opt/CAPEv2/storage/analyses/8848/files/b31d5b9a1dc0772c86e22c8629c5f92705c903fc3a1054bd52f71dc5bb21a328 - b31d5b9a1dc0772c86e22c8629c5f92705c903fc3a1054bd52f71dc5bb21a328
/opt/CAPEv2/storage/analyses/8848/files/becb7502a11eb66d5fc7337e8d88b0392debb13280fa60ec36f5891daf9a91f6 - becb7502a11eb66d5fc7337e8d88b0392debb13280fa60ec36f5891daf9a91f6
/opt/CAPEv2/storage/analyses/8848/files/f51490cea74e9cb983c0591ae03d1bd50dff1621b84f9a2555d864b77108f488 - f51490cea74e9cb983c0591ae03d1bd50dff1621b84f9a2555d864b77108f488

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://google.com/
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786364425&P2=404&P3=2&P4=aeMDuPlPklFdWVUXn8telsWNSkiz%2fEpWCTSwJL70cd1qdY9IzZIU4jYIzrLyG%2fFbl1sab9Ummzx3Dhn2hMGshg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786364575&P2=404&P3=2&P4=XlbpahW%2bDUKgOLlSGTDaFWWIfRSDprFm7gCZCZytrDY0ydEZDFKxSaJSstV9REJZxsa%2fJKp%2b4RI6SLzyZbr%2flQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.110.12.14
20.42.65.89
4.230.171.124
57.155.101.212
4.144.132.114
20.247.184.197
74.178.240.61
4.150.223.96
172.178.240.161
135.233.95.135
200.87.164.69
74.178.76.128
172.215.188.232
135.234.160.245
20.42.73.28
92.223.78.30
203.26.79.13
200.119.204.12
190.186.45.170
4.150.223.100
51.132.193.105
52.123.252.194
74.178.232.29
72.145.35.96
52.148.114.188

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report