MALICIOUS — 1df90764f0eba041d92ee3eb979492cb9569850c31211e5bcd174afdf6d437d7

MALICIOUS — 1df90764f0eba041d92ee3eb979492cb9569850c31211e5bcd174afdf6d437d7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the NabucurObfs family. 5 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 1df90764f0eba041d92ee3eb979492cb9569850c31211e5bcd174afdf6d437d7
SHA-1: dae5e5dad253f446723eef035967ec6dc2d3cdc5
MD5: 1b162079eef726e8395a96666915439a
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 12288:BaPX3R5flakj5ov6r/jfaW+NqS6jxom6GrP7jRwxx6qGrPRsWtDWfWdemYMAWLhu:EBJs8LeW+NZOom6MjIYFpxt0hzMAQhu
TLSH: T1A258EDC215FF3C19639DDAA53E2B6BE4024DBBC1EB6ED00F6C5362634AD52AC04660D1
Submitted as: 1df90764f0eba041d92ee3eb979492cb9569850c31211e5bcd174afdf6d437d7
File type: pe · Size: 1666560 bytes
Verdict: malicious (99/100) · Family: NabucurObfs

Detections (5 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

Dropped a malicious payload: bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 42 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

47117 behavior events · 2 ATT&CK techniques · 40 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8873/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/8873/files/ca6201a86b63cf0fcf7036c5ed9a64819314632edd3774779abca7e03172096f - ca6201a86b63cf0fcf7036c5ed9a64819314632edd3774779abca7e03172096f
/opt/CAPEv2/storage/analyses/8873/files/749c4d756bb12bbccb54f5fd8a10acdc1a81de6459bb9bd65acd1eb60ccc6ba4 - 749c4d756bb12bbccb54f5fd8a10acdc1a81de6459bb9bd65acd1eb60ccc6ba4
/opt/CAPEv2/storage/analyses/8873/files/9595fb6a47d1d57ffe613fd6880fbc767f3ea0ac9695c0641a7a18a43784518f - 9595fb6a47d1d57ffe613fd6880fbc767f3ea0ac9695c0641a7a18a43784518f
/opt/CAPEv2/storage/analyses/8873/files/90e5cc5a542b72fe0186c2bc05c367e843f84e1fb0a4d0827b542435c730af9a - 90e5cc5a542b72fe0186c2bc05c367e843f84e1fb0a4d0827b542435c730af9a
/opt/CAPEv2/storage/analyses/8873/files/806b3a97024540dccd3371c77e7c680d8a3c226b917fba7162f7f8f385df7bb4 - 806b3a97024540dccd3371c77e7c680d8a3c226b917fba7162f7f8f385df7bb4
/opt/CAPEv2/storage/analyses/8873/files/de98742ee88e054ca2d2f718ea34eafa84ae07c635a0e451aba7fabb3116830d - de98742ee88e054ca2d2f718ea34eafa84ae07c635a0e451aba7fabb3116830d
/opt/CAPEv2/storage/analyses/8873/files/81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508 - 81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508
/opt/CAPEv2/storage/analyses/8873/files/33d281b70f9ecf2fb4f5cad829b69e971b2a08312ff671278809c3fcce49e52f - 33d281b70f9ecf2fb4f5cad829b69e971b2a08312ff671278809c3fcce49e52f
/opt/CAPEv2/storage/analyses/8873/files/636408a4e6250fadcc77e9a38d64cd99c83409f97d0b7e64f188b0ee80774a6d - 636408a4e6250fadcc77e9a38d64cd99c83409f97d0b7e64f188b0ee80774a6d
/opt/CAPEv2/storage/analyses/8873/files/36efd87acc09ca837331194d749a1db0678e8cfff72c73f5b0980c93787b7e5a - 36efd87acc09ca837331194d749a1db0678e8cfff72c73f5b0980c93787b7e5a
/opt/CAPEv2/storage/analyses/8873/files/0f454b33fc06df512c54ed89d8a5918be7de1088acf8791d99e230a6987df615 - 0f454b33fc06df512c54ed89d8a5918be7de1088acf8791d99e230a6987df615
/opt/CAPEv2/storage/analyses/8873/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
/opt/CAPEv2/storage/analyses/8873/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
/opt/CAPEv2/storage/analyses/8873/files/eaa3f880b5cb480cf3f6e34a5210f1802b42a270a89604e7dbea849a51361988 - eaa3f880b5cb480cf3f6e34a5210f1802b42a270a89604e7dbea849a51361988

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786365824&P2=404&P3=2&P4=hoPsyYWihJkCIdWsGTACyymTZ677qvmunNJU55cBnuVmLEZC0pRbwNEuroPYqZi2nID%2bfEA3Dv7dvDt%2fHSj2Nw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://google.com/
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786365915&P2=404&P3=2&P4=cpXy5HiEtV9DoaMj4ZW3FnAC4rCAXw2ogzKq8A15a0SaNrgy56JvtDGVcORf3yw0UEpU2EA8opv0E5Cf44Li5A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

57.155.101.212
4.150.223.105
52.123.252.227
52.230.59.222
4.230.171.124
48.211.4.16
135.232.92.137
74.179.77.164
20.165.94.63
4.150.223.109
52.123.252.243
172.178.240.161
203.26.79.13
200.87.164.69
74.179.71.159
200.119.204.12
190.186.45.170
52.123.252.245
52.110.12.22
52.110.12.37
72.154.7.107
40.84.85.40
13.89.179.12
52.148.114.188
52.123.252.220

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report