MALICIOUS — b6b39c34f0eab42fc52110fc5435e7890341bff299eb18795bd481ef0ae2d3b3

MALICIOUS — b6b39c34f0eab42fc52110fc5435e7890341bff299eb18795bd481ef0ae2d3b3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the NabucurObfs family. 4 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: b6b39c34f0eab42fc52110fc5435e7890341bff299eb18795bd481ef0ae2d3b3
SHA-1: d816c9555d9fd48086bf01f4245fa0a86a9d12a7
MD5: c4e93c86cff76162394e15bb252c8981
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 49152:LWA6uFAJxwwH01dz9uMJFRpXRvvHk02Hm8rvVCCS3O6vmy9ERNhvzhFkdhJAVKmM:LWABiJxwwH01dz9uMJFRpXRvvHk02HmB
TLSH: T1C8580E3056E53161BB898024D9CD3ACCEF0C7093576BB12516A9CEDA8B76A270CB44DF
Submitted as: b6b39c34f0eab42fc52110fc5435e7890341bff299eb18795bd481ef0ae2d3b3
File type: pe · Size: 1666560 bytes
Verdict: malicious (99/100) · Family: NabucurObfs

Detections (4 of 25 engines)

Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Dropped a malicious payload: bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 41 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

34097 behavior events · 2 ATT&CK techniques · 41 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8770/files/e4a6b611a2826e69930334564e417321f873b45e7f1b15e2e87982651289e807 - e4a6b611a2826e69930334564e417321f873b45e7f1b15e2e87982651289e807
/opt/CAPEv2/storage/analyses/8770/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/8770/files/993f377a7174a558c58a7db6b54f07fa9b8072d1502d8c78dfdc06bd943c352a - 993f377a7174a558c58a7db6b54f07fa9b8072d1502d8c78dfdc06bd943c352a
/opt/CAPEv2/storage/analyses/8770/files/f1d26b96dc1a84f298a70b669540ed358c466725dfd4b6399f4d164a44fd7d95 - f1d26b96dc1a84f298a70b669540ed358c466725dfd4b6399f4d164a44fd7d95
/opt/CAPEv2/storage/analyses/8770/files/034908767d8de2438b278f2c7453b1cc3884925dfadb22afa33dc2cff301ab56 - 84160f7b923779d0ab9b88608255253e3f229ed896508e96d12432bdda2db67b
/opt/CAPEv2/storage/analyses/8770/files/7869ed6363742a68b13d3d89d890451d7efaac0ea5eb7e3b69eb225800c0781e - 7869ed6363742a68b13d3d89d890451d7efaac0ea5eb7e3b69eb225800c0781e
/opt/CAPEv2/storage/analyses/8770/files/0b2a0f8780d6a36ccaeccfef447d5647a767ed4c10cb259a71f839e08a23696f - 0b2a0f8780d6a36ccaeccfef447d5647a767ed4c10cb259a71f839e08a23696f
/opt/CAPEv2/storage/analyses/8770/files/913fd21034b647308b17b0189c70cf4528976ece60b75b4edd588321841a9858 - 913fd21034b647308b17b0189c70cf4528976ece60b75b4edd588321841a9858
/opt/CAPEv2/storage/analyses/8770/files/b27bdd91def4d5c8ea233b22ced6084f695fdebf9988a69eb1137fc50fbbf550 - b27bdd91def4d5c8ea233b22ced6084f695fdebf9988a69eb1137fc50fbbf550
/opt/CAPEv2/storage/analyses/8770/files/a2b97db75363cb662a4dbae84e97f21f3e3e103bcae3ffa15548ff4a0d461e5a - a2b97db75363cb662a4dbae84e97f21f3e3e103bcae3ffa15548ff4a0d461e5a
/opt/CAPEv2/storage/analyses/8770/files/5f4cc8838bd8c8e2de51a14b3a2a67d2d69288e8e205f50b5ea74336240fedaf - 5f4cc8838bd8c8e2de51a14b3a2a67d2d69288e8e205f50b5ea74336240fedaf
/opt/CAPEv2/storage/analyses/8770/files/796d510673eb1c6a3a71be990aafa3df78920a6815db6d1803b879e731158ba2 - 796d510673eb1c6a3a71be990aafa3df78920a6815db6d1803b879e731158ba2
/opt/CAPEv2/storage/analyses/8770/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
/opt/CAPEv2/storage/analyses/8770/files/4d4162dfd1a082c88b29b0d89666a7fc84f9e717d401cdb27bb4b1ac8b4f0d06 - 4d4162dfd1a082c88b29b0d89666a7fc84f9e717d401cdb27bb4b1ac8b4f0d06
/opt/CAPEv2/storage/analyses/8770/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://google.com/
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786359943&P2=404&P3=2&P4=CU2rLXs3nUbI6bVpuX%2fkDtJHjWzivQfsHamhXfKf7yqr3ZooYNBFq04NZDmwzq%2fXjqrgnuC6GjqYr142qIcwMQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786360069&P2=404&P3=2&P4=hpW3LCpn%2fSq%2b9Tm46IiOu1zyqmrSoTTMk51CZUh4aiZa5JKc49NOC4qEytcrqFE0xnjYDBhlxtCuVz3uzeKkbA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.110.12.42
52.110.12.32
20.42.65.93
4.230.171.124
40.84.85.40
20.247.185.124
135.232.92.137
20.42.65.90
74.178.76.54
135.233.95.144
92.223.78.30
135.233.45.221
200.87.164.69
135.233.45.222
200.119.204.12
203.26.79.13
20.42.179.192
190.186.45.170
135.233.95.80
52.123.252.240
52.148.114.188
72.153.5.61
172.178.240.163
142.251.222.238
74.179.71.159

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report