MALICIOUS — 9ea155491adf5ebeda95896563b172b87c4eb8542ed0fefd99f604144b753466

MALICIOUS — 9ea155491adf5ebeda95896563b172b87c4eb8542ed0fefd99f604144b753466 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the NabucurObfs family. 4 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 9ea155491adf5ebeda95896563b172b87c4eb8542ed0fefd99f604144b753466
SHA-1: 7a18afd63d12c308cb51e9d14f7a5193fd7ad972
MD5: 36e608ae7881b263b84ad9a013387040
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 12288:6rX1ADox3CKmdbh4M97CLYaV9M+mZ6lsnyFyzUPB8ZLRqn9CQRvqktWGHGlel:O1yoxR6aM9WqnyFqtYngQRv/H1l
TLSH: T18358A77DC8DE50FBD05A0F591EB8996B85DBC821D013B830530344ECB99606E25EA6FE
Submitted as: 9ea155491adf5ebeda95896563b172b87c4eb8542ed0fefd99f604144b753466
File type: pe · Size: 1680896 bytes
Verdict: malicious (99/100) · Family: NabucurObfs

Detections (4 of 25 engines)

Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Dropped a malicious payload: bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 37 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

41003 behavior events · 2 ATT&CK techniques · 40 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8870/files/11c19d062dd25f7416bd60c73d0270e1ccc28ef98c41e97e71b7c124f248c8c5 - 11c19d062dd25f7416bd60c73d0270e1ccc28ef98c41e97e71b7c124f248c8c5
/opt/CAPEv2/storage/analyses/8870/files/9dc83850a4979569721607466dc5be8d3f306390b6e620fb3945d3c1ebef6b4c - 9dc83850a4979569721607466dc5be8d3f306390b6e620fb3945d3c1ebef6b4c
/opt/CAPEv2/storage/analyses/8870/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/8870/files/ddc9ea0bf74f88ed3f4680c005363025d423800cf77e2c026b0308e120099fa7 - ddc9ea0bf74f88ed3f4680c005363025d423800cf77e2c026b0308e120099fa7
/opt/CAPEv2/storage/analyses/8870/files/224c7186d3183d19a8d68a8e84560ceed1e9cf1de9bc8fc00b4263166ba32b3d - 224c7186d3183d19a8d68a8e84560ceed1e9cf1de9bc8fc00b4263166ba32b3d
/opt/CAPEv2/storage/analyses/8870/files/0dcbf0a05c82623aedb1ee9d977379acb57722b7758852961d00995987b48194 - 0dcbf0a05c82623aedb1ee9d977379acb57722b7758852961d00995987b48194
/opt/CAPEv2/storage/analyses/8870/files/ed4c7fcc635262e3992592eac75a808e4f7a20f93f7fa8bdf9549bd5d01b0a14 - ed4c7fcc635262e3992592eac75a808e4f7a20f93f7fa8bdf9549bd5d01b0a14
/opt/CAPEv2/storage/analyses/8870/files/786433c29d64acf3336f69321fcb33aa73152888091b71123da2354e6be54d4e - 786433c29d64acf3336f69321fcb33aa73152888091b71123da2354e6be54d4e
/opt/CAPEv2/storage/analyses/8870/files/d1f52a2350507dfc96afc0494a3236bbcc520aca65a320af8d0c2a7c43e298f3 - d1f52a2350507dfc96afc0494a3236bbcc520aca65a320af8d0c2a7c43e298f3
/opt/CAPEv2/storage/analyses/8870/files/34725ff3aa62f23273d2513db7e8bff3305ad41b8a65e0992f3fb25a8f42312f - 34725ff3aa62f23273d2513db7e8bff3305ad41b8a65e0992f3fb25a8f42312f
/opt/CAPEv2/storage/analyses/8870/files/a57babddb00b46e8eeab4763de8c26956f0c8d7b798dce25c653a1e2d7ba33d7 - a57babddb00b46e8eeab4763de8c26956f0c8d7b798dce25c653a1e2d7ba33d7
/opt/CAPEv2/storage/analyses/8870/files/de2786420d86749e5086a0dad0678c2081974467be4461d588719ae4fc83ef59 - de2786420d86749e5086a0dad0678c2081974467be4461d588719ae4fc83ef59
/opt/CAPEv2/storage/analyses/8870/files/3321422c26f402df99752e93626a2dd0299ee7fb19771837331917ce6eb0121f - 3321422c26f402df99752e93626a2dd0299ee7fb19771837331917ce6eb0121f
/opt/CAPEv2/storage/analyses/8870/files/c164bd387ffc493a4a20ad1f975b9ec67aa1be8d37aecf5448e724b8f675ff70 - c164bd387ffc493a4a20ad1f975b9ec67aa1be8d37aecf5448e724b8f675ff70
/opt/CAPEv2/storage/analyses/8870/files/79825eccc00e8848e2a0141be90b82ed317b4396c738aff8bff60ec4052b0ae5 - 79825eccc00e8848e2a0141be90b82ed317b4396c738aff8bff60ec4052b0ae5

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://google.com/
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786365727&P2=404&P3=2&P4=lkrTSOnb9KX4ge9emF0kOo0kJEIayb04%2bSYpAjfwvsGUcucqmR4MKs3b%2b6ZbvBVuuKPJ3jo8yXoBteShj1aecw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786365831&P2=404&P3=2&P4=gJBhObKlneH2%2biKxQtb0VeDY85C9%2bG7QsIWYs1v%2bPxnLFcmwH%2b6txuz%2fteYlf1r3KOL%2bu3LucOPqyBiC4bblKA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.73.31
4.230.171.124
4.247.188.233
52.230.59.222
135.232.92.137
20.184.175.22
74.178.76.54
20.184.175.2
200.87.164.69
52.110.12.44
203.26.79.13
200.119.204.12
135.233.45.221
52.182.141.63
190.186.45.170
52.123.252.233
74.179.71.159
48.211.4.16
72.145.35.99
52.148.114.188
142.250.195.174
52.110.12.10
52.110.12.30

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report