MALICIOUS — 9429ff92ebe4977931484d5759daa351a1339a7051ee2fcfad2dae74764b5a4e

MALICIOUS — 9429ff92ebe4977931484d5759daa351a1339a7051ee2fcfad2dae74764b5a4e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the NabucurObfs family. 5 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 9429ff92ebe4977931484d5759daa351a1339a7051ee2fcfad2dae74764b5a4e
SHA-1: c14bb495bab5cbed0b8d639fd3e092f32e6a7d23
MD5: d430a79896c9a95eae1c7dd696236ea8
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 12288:a46w5Z6BI0zsiuIHxj8kYWpWAjy7URWxTEtLfpdPdxWOS2v:a46wd0zsXIHxQJWS4IxeLbdxWCv
TLSH: T1C658764C1B0E9C023963E65E59EE366C23AD81DE80CAD5D7DE8A0C7C201562DEDEC746
Submitted as: 9429ff92ebe4977931484d5759daa351a1339a7051ee2fcfad2dae74764b5a4e
File type: pe · Size: 1666560 bytes
Verdict: malicious (99/100) · Family: NabucurObfs

Detections (5 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

Dropped a malicious payload: bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 42 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

41267 behavior events · 2 ATT&CK techniques · 39 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8824/files/3263b1f94ceffc02979b0b44e4b155a16f6231d27b84f487259c3cc1dec93336 - 3263b1f94ceffc02979b0b44e4b155a16f6231d27b84f487259c3cc1dec93336
/opt/CAPEv2/storage/analyses/8824/files/1303c89e533899ea63a22dfd78b5482833b0379b51da963548a7e7df482eab5d - 1303c89e533899ea63a22dfd78b5482833b0379b51da963548a7e7df482eab5d
/opt/CAPEv2/storage/analyses/8824/files/d779d671359ccbdc64c55e3aa0c1058c83c2f164806b41d56189af136a6369ca - d779d671359ccbdc64c55e3aa0c1058c83c2f164806b41d56189af136a6369ca
/opt/CAPEv2/storage/analyses/8824/files/0adae6b788d3c6d4b0e08507df34791a947d6876839fbca17f0d31e42eadd5c5 - 0adae6b788d3c6d4b0e08507df34791a947d6876839fbca17f0d31e42eadd5c5
/opt/CAPEv2/storage/analyses/8824/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/8824/files/6ffebc3a6260fe229cdc70c87cdca0f817ba8a959806777dddc95c1c7ca1ce17 - 6ffebc3a6260fe229cdc70c87cdca0f817ba8a959806777dddc95c1c7ca1ce17
/opt/CAPEv2/storage/analyses/8824/files/0ca7579a0f2ad67b6cba5d8e032e9a1d77e47fe3cd911fec0ed7c3e72dcf19e7 - 0ca7579a0f2ad67b6cba5d8e032e9a1d77e47fe3cd911fec0ed7c3e72dcf19e7
/opt/CAPEv2/storage/analyses/8824/files/e1e5d5acb23f16fdc782e876dff492807467d36682ad5f76e57838dc486b93e8 - e1e5d5acb23f16fdc782e876dff492807467d36682ad5f76e57838dc486b93e8
/opt/CAPEv2/storage/analyses/8824/files/56f75629b2758c4480e75148cbca72534874c0b6f601757c52fecc1332bf41e8 - 56f75629b2758c4480e75148cbca72534874c0b6f601757c52fecc1332bf41e8
/opt/CAPEv2/storage/analyses/8824/files/ebb6c1b02b970e5bb2bf777f06cea29534cc8789760ab51877e408b762a276e3 - ebb6c1b02b970e5bb2bf777f06cea29534cc8789760ab51877e408b762a276e3
/opt/CAPEv2/storage/analyses/8824/files/de7a7a308057c4eabbb4856a00cdf6d59db6beb3d55981b30d2020d78d880925 - de7a7a308057c4eabbb4856a00cdf6d59db6beb3d55981b30d2020d78d880925
/opt/CAPEv2/storage/analyses/8824/files/e430073faedca6b00cca79ff14f793501890d4105068a3f3fff3a569ec23a772 - e430073faedca6b00cca79ff14f793501890d4105068a3f3fff3a569ec23a772
/opt/CAPEv2/storage/analyses/8824/files/c3880e5fcf87046a9d14d2e71727182b45ff1d67beff1255373e34477cbe237f - c3880e5fcf87046a9d14d2e71727182b45ff1d67beff1255373e34477cbe237f
/opt/CAPEv2/storage/analyses/8824/files/c19f77d0be076f6e7203559b352d0002125595f63738240b24dc394e37e93298 - c19f77d0be076f6e7203559b352d0002125595f63738240b24dc394e37e93298
/opt/CAPEv2/storage/analyses/8824/files/e90d1b03f1d3afd30e2f664412faadb2e97e8390a1608006ee173483d65afdb9 - e90d1b03f1d3afd30e2f664412faadb2e97e8390a1608006ee173483d65afdb9

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786362970&P2=404&P3=2&P4=R0tUyhGQVt9xsW3JWIbg749ndIRryA1B6CAt5AqvJ7ck3qfx%2fmEuinM7Wa2gxBP8QlVdxwxUKTfYVMQhqkV%2bBA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://google.com/
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786362987&P2=404&P3=2&P4=mX8oLn8QcErxchXI4x%2btmuF5WtzMlWpch96K9VkpsdWWO5wEfWGWYXdxOoQ5w9YIJ48a%2foACrptVfE0bEVlwxg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

142.250.195.174
142.251.222.238
52.123.252.220
20.42.73.30
52.123.252.224
4.230.171.124
20.42.179.204
20.247.184.197
135.232.92.137
135.232.92.97
51.11.192.48
135.234.160.244
52.123.252.204
52.123.252.240
200.87.164.69
172.178.240.163
203.26.79.13
52.123.252.202
74.179.71.159
92.223.78.30
200.119.204.12
190.186.45.170
52.168.117.170
51.132.193.104
72.154.7.17

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report