MALICIOUS — 84f4987d596e7ed13abce3051ac7cbee952ec69c9813f0de53de0eaa50202a56

MALICIOUS — 84f4987d596e7ed13abce3051ac7cbee952ec69c9813f0de53de0eaa50202a56 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the NabucurObfs family. 5 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 84f4987d596e7ed13abce3051ac7cbee952ec69c9813f0de53de0eaa50202a56
SHA-1: 84ede1563a0d06f8bf8efa4d55cb6783c373dae6
MD5: 70e4ab5abd354095ca6eea9a3a6fc683
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 12288:wjV7pna3f1UraNp7vOLl6OYyWseUl6+Tu9OSofRF40NtSKKewk2/VzSsQqgF:wjV7pna3f1UrJxdaylSQfSpx/VzSZDF
TLSH: T1C258A4326DFD20CEF4E1DB3B2F49C1CB935B09E9CA66BA74F069B44D18128C891C9855
Submitted as: 84f4987d596e7ed13abce3051ac7cbee952ec69c9813f0de53de0eaa50202a56
File type: pe · Size: 1675776 bytes
Verdict: malicious (98/100) · Family: NabucurObfs

Detections (5 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 9 weighted signals:

Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 38 external host(s) at runtime (15 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

32145 behavior events · 2 ATT&CK techniques · 18 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8927/files/7177106ffe0cd98a02add607472f09cde692025bc352240b2321046ff687377e - 7177106ffe0cd98a02add607472f09cde692025bc352240b2321046ff687377e
/opt/CAPEv2/storage/analyses/8927/files/9ec4969a595a16cfb5937de08048f4783ec4314beaca68ab8ae4e22860153562 - 9ec4969a595a16cfb5937de08048f4783ec4314beaca68ab8ae4e22860153562
/opt/CAPEv2/storage/analyses/8927/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
/opt/CAPEv2/storage/analyses/8927/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
/opt/CAPEv2/storage/analyses/8927/files/92367bf17b81d365d6d0c5a4272228db37bd86c0d5e36e51addbb70c54ac74e1 - 92367bf17b81d365d6d0c5a4272228db37bd86c0d5e36e51addbb70c54ac74e1
/opt/CAPEv2/storage/analyses/8927/files/d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698 - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
/opt/CAPEv2/storage/analyses/8927/files/ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51 - ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
/opt/CAPEv2/storage/analyses/8927/files/7178de3d853f28a2ad97383e7fe2b8dfb110254af5252a81f95322eca1dbcf26 - 7178de3d853f28a2ad97383e7fe2b8dfb110254af5252a81f95322eca1dbcf26
/opt/CAPEv2/storage/analyses/8927/files/5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e - 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
/opt/CAPEv2/storage/analyses/8927/files/91bba63b7958aea583eb90bf28e6c59a8cfbf2e269398f1ec646854a1db72c7b - 91bba63b7958aea583eb90bf28e6c59a8cfbf2e269398f1ec646854a1db72c7b
/opt/CAPEv2/storage/analyses/8927/files/0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca - 0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca
/opt/CAPEv2/storage/analyses/8927/files/609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a - 609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a
/opt/CAPEv2/storage/analyses/8927/files/a8b487fb8e6f21c1b783bee2471efd77029d6f24ee815fb78e1279c8a5ccd709 - a8b487fb8e6f21c1b783bee2471efd77029d6f24ee815fb78e1279c8a5ccd709
/opt/CAPEv2/storage/analyses/8927/files/b4af5f5c6fbb5edf28764d99824932c6753d79a4ce0bce8daaac728b916f303b - b4af5f5c6fbb5edf28764d99824932c6753d79a4ce0bce8daaac728b916f303b
/opt/CAPEv2/storage/analyses/8927/files/e8f7e3cf2f85593707f506ae3df88ca8052f9ab16d69b5dd45133c8821795eaa - e8f7e3cf2f85593707f506ae3df88ca8052f9ab16d69b5dd45133c8821795eaa

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786369269&P2=404&P3=2&P4=I8D%2bdxRaIHDMawOpPkG%2bQotVc8XmlN9dlj4YhWQ%2fMB4apEjg30tyD9fFbbrDPg6patJrnE9ds0XeiB%2bgzlOCKw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://google.com/
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786369291&P2=404&P3=2&P4=gqI1mJyU515Mbp0i6eb68wZvLL7vDqBnqFkYI%2bvMLWe%2bQ8CoTvX2yzNSAED69717OBgE3vAvWfGQgaTzdSUfwQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.0
40.84.97.4
4.230.171.124
172.215.188.232
74.179.77.204
20.247.184.142
74.179.77.164
20.184.175.23
4.144.132.114
52.168.112.67
74.179.71.159
203.26.79.13
172.178.240.162
200.87.164.69
135.234.160.245
92.223.78.30
200.119.204.12
190.186.45.170
52.110.12.11
52.110.12.37
72.145.35.107
52.148.114.188
142.250.195.238
52.110.12.2
52.110.12.45

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report