MALICIOUS — b789131bd8dcacea92bb2339109a96ae147d13e4fe4d812643524cfd55e84b10

MALICIOUS — b789131bd8dcacea92bb2339109a96ae147d13e4fe4d812643524cfd55e84b10 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the NabucurObfs family. 4 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: b789131bd8dcacea92bb2339109a96ae147d13e4fe4d812643524cfd55e84b10
SHA-1: b65c2ea90a1b2f2abfd18d7583d89446ee678be6
MD5: e76a65d753e65e4b94b7aaff94f9b0eb
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 12288:eXA0537phdI96cOr0DhBEgpERg3G1f+QgQYqq4BiwMGCUPqOpHakKetQO:4xW3OajEgpERjvYsHK4h
TLSH: T1035844887436510BF9E236F7BF4CA95782B2CF74F802FAA06692BCD06860D86D0D7155
Submitted as: b789131bd8dcacea92bb2339109a96ae147d13e4fe4d812643524cfd55e84b10
File type: pe · Size: 1678848 bytes
Verdict: malicious (97/100) · Family: NabucurObfs

Detections (4 of 25 engines)

Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 8 weighted signals:

Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 34 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

32717 behavior events · 2 ATT&CK techniques · 19 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8794/files/fe1e8e77e470f5663b4fe93a5059d3b2c86c5a5b7e54854f30b025113936eaf9 - fe1e8e77e470f5663b4fe93a5059d3b2c86c5a5b7e54854f30b025113936eaf9
/opt/CAPEv2/storage/analyses/8794/files/9e28d024455d4ebfec7bf613419d79a6a5ce7b10721e1c32dd3ca6831d74dec1 - 9e28d024455d4ebfec7bf613419d79a6a5ce7b10721e1c32dd3ca6831d74dec1
/opt/CAPEv2/storage/analyses/8794/files/bb0de45c868c5d8c5e5a9f56b655e8524e90378c71189ad7f5c4abc850b01672 - bb0de45c868c5d8c5e5a9f56b655e8524e90378c71189ad7f5c4abc850b01672
/opt/CAPEv2/storage/analyses/8794/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
/opt/CAPEv2/storage/analyses/8794/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
/opt/CAPEv2/storage/analyses/8794/files/1635dce0eff793bf51a655ac47bd548dc7e4477d4f58216ed719647cb51d7744 - 1635dce0eff793bf51a655ac47bd548dc7e4477d4f58216ed719647cb51d7744
/opt/CAPEv2/storage/analyses/8794/files/74c290e0888df2230593203d64a5479a28600e2b346af0a12f94865ceac98016 - 74c290e0888df2230593203d64a5479a28600e2b346af0a12f94865ceac98016
/opt/CAPEv2/storage/analyses/8794/files/d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698 - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
/opt/CAPEv2/storage/analyses/8794/files/ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51 - ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
/opt/CAPEv2/storage/analyses/8794/files/5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e - 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
/opt/CAPEv2/storage/analyses/8794/files/3b692a3f6bbfe96c98cb8e0984db7ec91cffafdc88625c740c7400024d832feb - 3b692a3f6bbfe96c98cb8e0984db7ec91cffafdc88625c740c7400024d832feb
/opt/CAPEv2/storage/analyses/8794/files/420ce04a175730291ec54b1909cae23dd20626f670e5ae21ed04699a7b67723a - 420ce04a175730291ec54b1909cae23dd20626f670e5ae21ed04699a7b67723a
/opt/CAPEv2/storage/analyses/8794/files/0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca - 0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca
/opt/CAPEv2/storage/analyses/8794/files/609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a - 609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a
/opt/CAPEv2/storage/analyses/8794/files/3fb6285f9e1caf351c90f9c1ec8b1ecedb4d6fe13b2706ca67e60e745907f0ef - 3fb6285f9e1caf351c90f9c1ec8b1ecedb4d6fe13b2706ca67e60e745907f0ef

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://google.com/
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786361279&P2=404&P3=2&P4=KAIUCEIvDM9wJVlD9O5E7PON52gCsqectLEHb5JeNOcMinYM95GWkJb0Alp6ewzcqCW7Pfg2MhE8u08uQzx%2fkQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786361303&P2=404&P3=2&P4=lzrM2LESDPM6nap9uENVXrKj5Xhrq3%2bSx33a9LkyC8nfSuzQVV%2fnYS9F%2f12r0gEHgtoAm1%2b%2fHS3tztw3CLFXgg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.168.117.171
4.230.171.124
172.215.188.232
52.230.59.222
74.178.76.128
135.233.95.135
135.234.160.245
200.87.164.69
135.233.95.80
203.26.79.13
200.119.204.12
190.186.45.170
72.145.35.105
52.148.114.188
142.250.195.238
52.110.12.8

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report