�hX7����пND�d`��'����Wrs�09!{�T<z4ڇ�r��hb��]���ڬY�S� h$�$�Z���y����:b�}IN=b:K"?�#����Iu ���|$;ʚ�T��w�J����x_����$b��Ί���x<4���q�\Jd�sL�,�{��`Z &L���Cp�b~��G����U�#�bS�Q����E���G�3bO��N�j�H���v�3��dH�K𛊐″^(Գhmvud֤֟�����Q�.:^ڼI�n>Q%`<�V�R����N5|��U5SnWDk8j>�d�`n��5���#�,�3\�9��Ji�\�C:- � !���̱ �$��K+�5�*�%�����Z��( ;�TV���~g���ct����鄅#����?��@ `�K�*ґK:G���� t���/�=ٝ�ş,9�w��=�d^� c$�s�ȳ���P5����5���}Ѱ�0�V*"�쀃�)3<��y���b�����7bû4�YG��y��Z����-���w�Aݖ�^[���s8�r`��*=�A���{�� >\�Z��-��P�V��6�g�Pa�.A\�x������t�s�e-\��/�]�2�»F����5�@����`��1C��X� �NJ��[C�od7�4خ�� g�����~�q�S!*~!L��*z�ZÇ�_~�9�3S��^ ��1����A�W*T��Η����w)PZ�!|�d��.�.ץ�<��鶐��vA<��۶�<+ aT�%��29y"U4��̱dҸH�/���K�Р��Q�n��.�����S�%�H8��9hф0�`��TT (|�T��<脢�u�zb5�ߛb.��W��3�Sŝ���_r�D��B)���,Q�OfVu�z���|7��k���.$�@A�s��ѐ��<|�@���5Z���-0 *�AB��Bʕ�����&ƞ�QK^�%��rDž�E?����V?�'>�SȾ~x(g�(FI6�;��_��nM7I�Q�,�O�`������ �G}[x����F�7q�Ev��U���Ӳ�C(q��'?[��C��ş�ݿ�9> ��_t���ZR�$�0����$�ϿLT:G�٨U�������V�!j�y�1��g��%p����C(��-�R��'��ʦ8���S!ޛ�3,s�j��^�2P��T}���w�@��M9�L� L ���T�n���:�R���5H�8F�f�����r6Us�y�VẄ���u�BU�U3.������PƜu2�kf�c]ƾr���Nd���������E�)��R��Y�Y� �����И�Z�2`O �qD��݄�K�/]�V�Q#��a��� J�&dD���k�:�����`��_��c��<���:�d e�5b����H2�� &��(��XD)�އ!�t�w�����D�7}��] Nw�*4��6������:�|��e�9Wc��dv��� hQ��<�u:}���aQ������d��s�Y�w ^��o������I��d7br������8��~z�/�Ϩ��L�U3��W�ϫ� �v<5C�7�̂�ѻz�%Gy��o�"W�gd�\8+tw�Eί|�#����\yR#aҠ���e9�/�I���{</r(���P��W&��YEK}�\�8��V�Ь@$���0w���3Q�=E���SL:��\��mu%����B�}��:04�~X���֓ϐ�@�1���E`����3��Xxs�hK���k�R�<�n#e�M?�w�^`��4�|��������)���ܹ�(n�ܔ5â4����E���-4��8���Nj�f�em���4�b�;��t)q��~�Q@���Av,L�ܒ��a���� ZT*6jub�P �)HQ�\�0H�`?@�Q�Ʈ<hΧ�^��5U�QtTͽ�[qH/��rM��#t5_�kx;=��Hҹ!8w�R�{!21?��K�Q����i5h-������BA\T~|~A x\��2|T���#5y:E���~8P�Y�_B���>h�ޝ���*B�X67���M��1��۶ր�Sy�-g����M������F�f�a�.#�e��}�5M��E���f5��M��Dg�����ZJ?L�`NmzJ��r��:��zJ4_��/A3���~`:d��?����5C��%��� I{�!"�V� ��G��VAq��/�Dث�K�v~q�h�������4�3o]E��pTP=cj�m+��|�J8����t�t��XTkԅh���(� � SZ�b����G�hۥg}������46I�������ZC��٨�k.<�����aR� �dwJ�f�2����偷7(�U ��mg�N d4�Y������6�'���W�N�A�FKJ}T�do�2���ٱ��W�^@Y>O���u�����o���an���']W?s���X�"G��]��̿�����"0AU�:z�,�Z��"WJ3��w��cVY6{���#��EC����Z&#�tA� Ӄ���ѓW-ETHO��~/����L[���H��� ]+��R�B.ʎ�܅{\�NZ���Q��JK�|������q �W��s$!���JQ� �[\���`�g/�p?T�4{��Fx��-��]\�������u�˚LM-g��6�R��`�%��:}���ś�<�Zk5���Q�&=�?�" +��1r�_g���c��<��-!H*a�e�{�y�LY�m+�Ђ��{��h'$=ʆ��ֳylS�0�uŌ���}f�.�ް[n4��88U������a�p8����.J\G�������Qwr��@�j��Ap����3&nj��<��ώ��O9>m�˔������M҂Ӆ��(5�x�Dm���qB���b�D�����m~�H=��z��n<V��'7è7I"�P�;�1O�@Bt^*�x��T ��8�c \��9��a; 34l�� ��h?}�О��`��On�7m���iɝA���[g�3b�9��S5q�/7ȲUCH0��/M��!�pB]����n���9$�l�G_w�Zv����Σ�~��gM!��*�����"r5��s�@3o��k���c�bR�k0�X�.w%c5BweM��Ȝ<N@*6���Y iS�o쨘�1,,���ڪ`Rv�Oe%1�Ix ŎR��Cld MKƚZ:�5���ƪ�1ih#��ǭ)�wX �Sh��Y��^�d� U9�����It�KJ��.��~�M#!Y�p==}�{�An���d�?;�G�AF5\r�d��1T��nx�k����� ����J�ƾ�U�����ʜ0r.Â�Y�[T����f���~��Z�E�8��Ne�������c��ESq�p�Ul��?J�SVwt$Z7FG{:+����m��#�&:���͔��NY�r_iD�zn�[���ׇ%<Ie�fH�fc|2 �q��������b�b� ���{j�3:�~)�#����Ea�� �ژ� �i�����מ��6���CX3kUo��]�i�H EDB�Y#���y`;���VVR��F�`rV���iy ����52��Ŏ�9m|�}�R���k���+�/�ʚ�$��g\l�����*��&�;�:=pU$߆Y�R6�<��>�4�� �5ɽ4s�I�!���0����]�L̈́�U����$1��
Static task
static1
Behavioral task
behavioral1
Sample
Nebula.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Nebula.exe
Resource
win10v2004-20240226-en
General
-
Target
Nebula.zip
-
Size
5.4MB
-
MD5
1c70b9a59a2deb681aaf5d7bacb1de87
-
SHA1
27e4810f08b938af67240cfa455ecb1ca17e7335
-
SHA256
7a9bbb942119d519e38697efef5099eadba3f1cb4efe31199badbf32fc1dbc87
-
SHA512
5b8cc61506f5439a72fa183aec91a0a4ff5111ddc10270129b93a5a33e652753cfaf29d07ffa19458059e134464a575806e79f66df3d8deb04c8b964fc4d8c08
-
SSDEEP
98304:kX0gp03dsbP0lTDcMLVLdsDj22oVhKeduc1hDyV+pFBpfwyZ9g0r9R+/XR5:k5YsbPATDvsX2TVhtucDOV+pFBhwAO0K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Nebula.exe
Files
-
Nebula.zip.zip
Password: NEBULA4
-
Nebula.exe.exe windows:4 windows x86 arch:x86
Password: NEBULA4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 3.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 266KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE