MALICIOUS — f8eb2add883aec311f8cf97f0029ad604257cfc905e083c8bd7a77a2955563a6

MALICIOUS — f8eb2add883aec311f8cf97f0029ad604257cfc905e083c8bd7a77a2955563a6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the NabucurObfs family. 4 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: f8eb2add883aec311f8cf97f0029ad604257cfc905e083c8bd7a77a2955563a6
SHA-1: b61905f19b34fde8de2496a4521b955d6fa3b98b
MD5: 326b286b40b54143ff0af56aba68c3f4
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 12288:0qWqrXLlLK5tbWOBRVgortXzSXovdphcURgXhGcdoQm7XfBc41rVEosnqS:3WqrXLsBBzKepFAhGcdROJc41rOaS
TLSH: T17258B7ED8DBEDB820C9DFA35A380436CD9E46C65E971FC0002A3384D2EC9E1B6515769
Submitted as: f8eb2add883aec311f8cf97f0029ad604257cfc905e083c8bd7a77a2955563a6
File type: pe · Size: 1666560 bytes
Verdict: malicious (99/100) · Family: NabucurObfs

Detections (4 of 25 engines)

Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Dropped a malicious payload: bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 40 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

29921 behavior events · 2 ATT&CK techniques · 37 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8871/files/f1994bd20f3eb1cdbdfbf4a17b75dca9959af6145aadcd5ecb38b309ffd7c96e - f1994bd20f3eb1cdbdfbf4a17b75dca9959af6145aadcd5ecb38b309ffd7c96e
/opt/CAPEv2/storage/analyses/8871/files/54bb7179c750faea9fbc70e2d277720baef486b883f20832e1898677ae78f31c - 54bb7179c750faea9fbc70e2d277720baef486b883f20832e1898677ae78f31c
/opt/CAPEv2/storage/analyses/8871/files/937e9fdc671e97e761a984fa74d5dca20487ec54ee66764cf976eb9a2e110d59 - 937e9fdc671e97e761a984fa74d5dca20487ec54ee66764cf976eb9a2e110d59
/opt/CAPEv2/storage/analyses/8871/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/8871/files/f8ee44058ef55ba130b281183b690cb91828cedad345d1b48d0f9d45cb5052c0 - f8ee44058ef55ba130b281183b690cb91828cedad345d1b48d0f9d45cb5052c0
/opt/CAPEv2/storage/analyses/8871/files/113c88834057892908c742d148a1fe3359746f8c3ab952d08f467e319ff27bdb - 113c88834057892908c742d148a1fe3359746f8c3ab952d08f467e319ff27bdb
/opt/CAPEv2/storage/analyses/8871/files/c86b02f8792271cab8aa55b285e87b523259aa2ae66f4aab76b0df23c63bbb23 - c86b02f8792271cab8aa55b285e87b523259aa2ae66f4aab76b0df23c63bbb23
/opt/CAPEv2/storage/analyses/8871/files/254c6efb3d3eeddae2f9b5e6b2d4d61756318d5bc89cdf9e4da2e37ddc97396a - 254c6efb3d3eeddae2f9b5e6b2d4d61756318d5bc89cdf9e4da2e37ddc97396a
/opt/CAPEv2/storage/analyses/8871/files/6b4c52927e03c408a3a44356d2cc4e6089e86f55927ea1777534651304e15ac1 - 6b4c52927e03c408a3a44356d2cc4e6089e86f55927ea1777534651304e15ac1
/opt/CAPEv2/storage/analyses/8871/files/7fb493ff29231ce581133db6770f68c3bbc97aefe0c61e1a25a87eec740b2575 - 7fb493ff29231ce581133db6770f68c3bbc97aefe0c61e1a25a87eec740b2575
/opt/CAPEv2/storage/analyses/8871/files/79db64e46b917772cd7081b8cb5e9ca9fcd0180ad4439d807586fd59d6fee6b7 - 79db64e46b917772cd7081b8cb5e9ca9fcd0180ad4439d807586fd59d6fee6b7
/opt/CAPEv2/storage/analyses/8871/files/ede7cb4f1b98fa99467cd5f7290ecc1f866d7b34540acca8da71134a53824dc3 - ede7cb4f1b98fa99467cd5f7290ecc1f866d7b34540acca8da71134a53824dc3
/opt/CAPEv2/storage/analyses/8871/files/b19142463f107fa6646fc6692a37cf956ca91ef27280b4cbd26792b675310e83 - b19142463f107fa6646fc6692a37cf956ca91ef27280b4cbd26792b675310e83
/opt/CAPEv2/storage/analyses/8871/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
/opt/CAPEv2/storage/analyses/8871/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://google.com/
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786365746&P2=404&P3=2&P4=dIWv1718qRWt4LffOxRhTGTD6iCYLOa5bvml%2beszZ0owhHVFjD7P1KqdAQaxL4bE%2bb%2f7xoI%2bQxROtf8h2n2wGg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786365845&P2=404&P3=2&P4=YnSfC6A04qEIegrnfl3HXEeDWiYEhfCSAw%2bhcy34beqCfdBpFXmwwXxOydAr1zL5t7oEX6rXaWawdrBWPwmTrg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

0p.pw

Embedded IP addresses

20.184.175.18
48.211.4.16
52.230.59.222
4.230.171.124
135.232.92.137
74.179.77.164
4.150.223.115
135.233.45.223
200.87.164.69
135.234.160.244
203.26.79.13
200.119.204.12
190.186.45.170
52.123.252.227
74.179.71.159
52.123.252.239
52.110.12.55
142.250.195.174
72.145.35.99
52.148.114.188
13.89.179.15
52.168.117.168
40.84.97.4
52.110.12.54
52.110.12.10

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report