MALICIOUS — 8658fd1154a9667fdfb35fb5017aa4d86278c691afa2732db0c6692aae1e338a

MALICIOUS — 8658fd1154a9667fdfb35fb5017aa4d86278c691afa2732db0c6692aae1e338a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Nupik family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8658fd1154a9667fdfb35fb5017aa4d86278c691afa2732db0c6692aae1e338a
SHA-1: f6e3a8f56559a34e6ae4f8b19a435c3406821248
MD5: aa3ba67482bcc5b8d5838c0a0b9a320b
imphash: 532816589b7c9c3bed0fbcc3d1503ba1
ssdeep: 3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/e85pjBFy11AwC:o68i3odBiTl2+TCU/phuhuIp0
TLSH: T130427E7E4F2B7B03D132C6580D095E9F0022B49EA13D54885A63947DA7FBC27BA442DE
Submitted as: 8658fd1154a9667fdfb35fb5017aa4d86278c691afa2732db0c6692aae1e338a
File type: pe · Size: 207474 bytes
Verdict: malicious (100/100) · Family: Nupik

Detections (6 of 55 engines)

ClamAV (daily): Win.Worm.Nupik-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: Worm:Win32/Delf.BE!MTB
Emsisoft (Emergency Kit): Dropped:Generic.Malware.SV!p2p!u.AB9A06E4
Kaspersky (KVRT): P2P-Worm.Win32.VB.dz

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Worm.Nupik-1 (rule Win.Worm.Nupik-1) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload: BalROK.HTML - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: 3.6.1.0, 5.0.3.6 - static signal, weight 0.35, confidence 0.60
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1541 behavior events · 1 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Windows\winhash_up.exe - c2b01d9eb69893696969be337641da29bcba0c53914b8a20af7dc7bdef675676
C:\Windows\SHARE_TEMP\Icon12.ico - 67bc1cd876f5059789b0dc8dc16c0b2155e55aca8d1c8439d70c8882e1875740
C:\BalROK.HTML - 3959c5532031a58119c317dda15ac9313505df4a92c004cd2e76b071b0fad4a4
C:\Windows\SHARE_TEMP\Icon6.ico - 0df5c718b7aee9f045f804f6a53cb0727f66e1ac1df612c6ecf342aed81ce130
C:\Windows\SHARE_TEMP\Icon2.ico - 00a339ff5338d0cfe91b262175eef4e5fd07f9d28e8f980a1f5ff43a5a81e597
C:\Windows\SHARE_TEMP\Icon7.ico - 71acc5a88debfdba0eed23272ef4b09fd6609eeb4b1ec457c72444472ad8b3a4
C:\Windows\SHARE_TEMP\Icon3.ico - d2770f68db717c5335ceca3f2b0be1e294839a4904d3525f4c5e9847654d39c2
C:\Windows\SHARE_TEMP\Icon14.ico - adb0b5eb4fcfcc55c40eaa2ba3d142ed413293b2212bb2a1ddd8ed062db004bf
C:\Windows\bugMAKER.bat - ee349dd61e95c8b5a08bfb4af3009fead95a6c36d9fb4b9df2441d3be915b29b
C:\Windows\SHARE_TEMP\Icon10.ico - 76f05dd79b2d3a08baf928e4811b0f179e96ac351ff8007f2e24f5fbb4b95253
C:\Windows\SHARE_TEMP\Icon5.ico - 462d333fc849166df8cb4e9ba6edd8404f4d79ebcd535125ecb5e8fe9d2cc0e0

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787895997&P2=404&P3=2&P4=ig3JkvrgUiCQ4GdWHjr%2fBdPwEMFM0C%2bXGVn794qMxeis%2bFnSU6kxE9lBZjhspjAMxt97fKJMUgdXZlT6Ydtq4w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

3.6.1.0
5.0.3.6
20.184.175.22
52.123.252.194
4.230.171.124
85.210.196.11
20.247.184.142
20.165.94.63
20.165.94.54
20.184.175.10
52.123.128.14
20.112.250.133
40.99.133.210
52.123.129.14
20.184.175.12
172.178.240.162
203.26.79.13
52.148.114.188
52.123.252.232
135.233.95.80
135.233.45.222
57.150.192.97
135.234.160.244
72.145.35.104
52.110.12.24

File paths

C:\Programme\eMule

More Nupik samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report