MALICIOUS — c25efbac96a3f36e49948c1a44fdd4b7efa5328744b8cf332045ad2568f06233

MALICIOUS — c25efbac96a3f36e49948c1a44fdd4b7efa5328744b8cf332045ad2568f06233 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the NabucurObfs family. 4 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: c25efbac96a3f36e49948c1a44fdd4b7efa5328744b8cf332045ad2568f06233
SHA-1: d6619302f95b1208dc5de76f9767c4389bab360c
MD5: 3c0bb11e1c54330dc744c7b4ed6aa3c6
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 24576:an16FzV2gBMFW3NC4TqEJTzYyCECr7CIAK:s02m9C4TRzXo7sK
TLSH: T1F55ADF58E0CC68DA63F44B61FCCE4F12DBEB2C9EE08D2D01C6A59D2556CDAD93B56080
Submitted as: c25efbac96a3f36e49948c1a44fdd4b7efa5328744b8cf332045ad2568f06233
File type: pe · Size: 2038784 bytes
Verdict: malicious (99/100) · Family: NabucurObfs

Detections (4 of 25 engines)

Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Memory forensics: 7 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 5904) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 38 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

38209 behavior events · 2 ATT&CK techniques · 19 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8867/files/ff876ce811ec9832ed0e77efd547aebe3f474785c41ebc5df326f48f42717a92 - ff876ce811ec9832ed0e77efd547aebe3f474785c41ebc5df326f48f42717a92
/opt/CAPEv2/storage/analyses/8867/files/2978c9092d6d5c4ad7a35907ccad75ed3e3a02777bf9e6df7aecde195880b536 - 2978c9092d6d5c4ad7a35907ccad75ed3e3a02777bf9e6df7aecde195880b536
/opt/CAPEv2/storage/analyses/8867/files/6de7d05e489025a5f43277d458a1393c1a4cb23ae04621a75a9e942770f6f161 - 6de7d05e489025a5f43277d458a1393c1a4cb23ae04621a75a9e942770f6f161
/opt/CAPEv2/storage/analyses/8867/files/a07c958dbeaea574d5fc5cd486c6613c1cd5e6c635c9de6e5b460fe97870be3f - a07c958dbeaea574d5fc5cd486c6613c1cd5e6c635c9de6e5b460fe97870be3f
/opt/CAPEv2/storage/analyses/8867/files/09008bd286a2cff5f09d032d1ff83f72bd5056f6bd4fb81dbf0e1a955340cfb8 - 09008bd286a2cff5f09d032d1ff83f72bd5056f6bd4fb81dbf0e1a955340cfb8
/opt/CAPEv2/storage/analyses/8867/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
/opt/CAPEv2/storage/analyses/8867/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
/opt/CAPEv2/storage/analyses/8867/files/d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698 - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
/opt/CAPEv2/storage/analyses/8867/files/ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51 - ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
/opt/CAPEv2/storage/analyses/8867/files/bffe79d592b956e133f01ce60ff75b8a2c34708b48122f43c69a98aee568b2f3 - bffe79d592b956e133f01ce60ff75b8a2c34708b48122f43c69a98aee568b2f3
/opt/CAPEv2/storage/analyses/8867/files/5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e - 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
/opt/CAPEv2/storage/analyses/8867/files/2f7b5bc3001bf6d54fd4dbac6fd15f551506aeff9bc5018910e58151b1009df4 - 2f7b5bc3001bf6d54fd4dbac6fd15f551506aeff9bc5018910e58151b1009df4
/opt/CAPEv2/storage/analyses/8867/files/9f41d010bc46d3a41785cb3bd0d565398a8aa6ea244e5669f4e2138a7f049567 - 9f41d010bc46d3a41785cb3bd0d565398a8aa6ea244e5669f4e2138a7f049567
/opt/CAPEv2/storage/analyses/8867/files/2d5bd2889707eb202dec8de4cda5faf9c3deffb8907a4817e5a4cd43446f9b75 - 2d5bd2889707eb202dec8de4cda5faf9c3deffb8907a4817e5a4cd43446f9b75
/opt/CAPEv2/storage/analyses/8867/files/0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca - 0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://google.com/
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786365496&P2=404&P3=2&P4=fvO11GFlD6makoM3iCchBk6rIdsH5978GxKApX9hByhR3mqbBRR3wLcESCj7zU8Ia9kVfnBIlfFtwWHVUkmmtA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786365639&P2=404&P3=2&P4=d9YzXGbEwE7XaGHzz8EbTaAt5EyGlNI2otd%2fOpeaAIxIhNEfo8e9nXgN5XjILC1MYz%2fA4r3rM8WjdZVO7TgQfQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.11
20.247.184.197
4.230.171.124
172.215.188.232
57.155.101.212
74.178.76.128
20.50.201.201
135.234.160.245
74.178.76.54
4.150.223.101
200.87.164.69
172.178.240.161
203.26.79.13
200.119.204.12
190.186.45.170
52.123.252.218
135.232.92.34
40.84.85.40
72.145.35.102
52.148.114.188
52.178.17.235
142.250.195.238
52.110.12.2
52.110.12.24
74.179.71.159

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report