Ѡ��4���WOՄ������l;�.��*��8���w"?��ͱ9D�l����Z��$V�u��PkS�0y'�)�����߿vc�UG��Q�!�̱��M+<�K?mO����<�)+p�G9%�7���A���L��c[�>ՙ��XU��a�����B )�\ǠD��?�O�3/^ޛ���$ �;:��S����W(&��������G�9�e����]�^�.z�`���M>n5���+����H�U��ؠ1x;��z�)��i/��ȶ�6��Lo���?x���c����[�� �`��Bڒ δ�PI]k�,�c)��U�eB�a���vj��ݚ!�, �Pē��}�w��zhc�|�S\}�^-�hwi��t�lq$`}g��SO���4g��gܤ���I�^��G�G�&�M��?�q%Y ?�o_��Y�Ԍ;�n���'��/ 'T����!Cm"XH�P�:���=�K0�ߣ��9��>ue��~Bl�|T�٘�i��֯ʍ���R�A����@��{���VP�����\+�@���R �J�t�{y��`a:3���c�*N�D� ����5 ��\iUD�Ֆ��i�#�e+0̀��:��z��U$q.�B�Y�K��P=X�4?��=�"ˌM�~<� ��h)�<��E�:Q{�~3��R��rS �7���@��*"��)$C��a��oB�V�ɏ�fẁF�UI�ʀ�+��Xj����[י����gJ��g��)1�@u�9�!����!�(Ӗy����m�� ���X>�v !�BI�������^1�s���f�>�~� ĠFiD�4�E/�<�<1)��tz���$㲓��sٶL;�p@�"�AH���/���:4�|��Y��܇b��uSŒ��y{�3]���v&�#Q+�y+�m��<�xR9���0�Qci� �O�3H��괜���wȀD�� r�l:+��ۜ7��l�#Č��-�+mS�]��o�7<�PQ$tૹ��G���RZ�a3Rz�+"���;ܥU�ܗ�?RM�(3�� ��+���}���S �a�Jj�7��� ~_B-��-��t��ΦK�$v��Dy�9\HI ��'}*�PY�0��Oɨ�Y�Ԕ" �����A�]�|G�t'[H�E�����+�C�G�:�Yq\��6�EBϟ�$~p�B�Bl&R_����/�ۺ�P�M��5��Z��}�7/u��jE�C�� �H�l0i�͌�N8H�<s�������Q31� �^��;�b 3r�%r:�������=3�����O<�aD`d���:cI槐��ӛwĪ���f��?w�6L�� ��|%�j!B4�t�{�����y��S�������ҔF`7���9�������.ZY�E|�|�� �l�����K��-�F�Qk�\�^��W��d�Xv�D�e�Ӕ1��.��A���ڴ���0�Vr1�쯼�]i���#9��V������E"g;�v^�Z�@)xL`a� �V��b�Y�����]��G���.���U����/i��&�;qŪG�IS! -`���n���G&٬��!�}Q@o�t'�2Y���Bw�2��H�������=��ޭ��OT��x¡<8'Pk?�#�p @Kj+ש��%�V�[�n���B!�d��tfy?k>��a)�U���B��Os����:'<�����>Qьf�����y� ��&l�����k^p����[�o���æ��މY��/w]�����d�HO���8F��0���+�6��oP�]�8U�G[9�B�K�����϶pV���VسaVy*+���_�ZAq�8$T����F�p�����y9�.G̟`?�0���z]�rf�X��E�ivQ�SV3^�+���=���>��X����Z0��8�������S����)�6��i`�g�Z]I�b=q�r;��L��%a6B���k.�+vW���aV��\����k� c�\c��J��2^]��_�32� �,�}^s��>?x����خ;��D�����U ���(_C�?���,�e?JS����}�E<1� �JɎ<�%|����rkjwL��ٌ�V(�/%��H���j=��ppj���`�,뷙L(bj�} *�(ͅ��T���%�c0똯�/ ����b ���N��i=v�J+�ܭ =�0Q��3����R��FP�K��Eן��(c�Է]��tÀ�[���U�z�xwހf���K�J���GƀK�ސ�?T�|33F��].2��1lꡭ.9:�mg_�1����V�� ���"y깝�t�-�jA�r�g� X�?�}<)���͚E!��������E�?��pϔ�q"���]!t��X�4���ݍ?� F-f}K�9 �ͳ�3��k9������8�HT���\_��ɧ\�������L�@h�sUm�<��-]����C�/P�?~����ӇM�����j�����xx·^M�0q��E.u��3���3x�$q� �nN�ܺ!����Wk����F�%4�V3��|$S���P���.z��MC��� 7�ڑ�r�����ŵ�D��!oPc��%��h9�i�����[@Z����"�PO��,����]���������c�˨�ӝ۾��j��x�)#�������p§���-XQ~Ԙ�B%e�ۿ��+ ��ԍ�xTN�StJQӮ?j�{�2�Y���y���q��f�k)6{��XO�F�Ec3g��a���g"�E��a�z��<��D�#���M7��&T(�^(|�OJ�#��ϯv�x�F��5�d<6YGܓ����0\�G��b�)5�R6Kb7k}�*�XN��5��3�K �����ۋ[�k��z����Q��Ns ���lH w\nl�Hc�jO��T5�}���e�z�X�T��#�ۻ����v�{/D!0����^��@7t�/�U"�����up��䳄پ�h�֏%$��wV��Э�ܪh�r�[��a'nC9:�uj���N(P��"*|0�1��qm�KZ$#/�s H�t &�#�5 �m��^��G6���N=ѧ�(�����b� �ʪX���ʕ�fP��NU��~]��e���
Static task
static1
Behavioral task
behavioral1
Sample
Nebula.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Nebula.exe
Resource
win10v2004-20240426-en
General
-
Target
Nebula.exe
-
Size
7.4MB
-
MD5
7b2c73f58293ad124346ec84b4ed43fc
-
SHA1
762088efe02b58cb1f371c236b6e3be45827889c
-
SHA256
35e0d384d4356b29bdc1215f966f960972bc38bb8a7349d2f623981a5c58d13c
-
SHA512
b195dc37c606bb03204308a1c1da71cabbba0670cd7a4e731801e85fe18587a71f91e4c8d7a20015b903b9b7dc0945aa078f63530bdb5f1f39accd82e9f15547
-
SSDEEP
196608:q1GhXoKogezH4Ht8vpH0qD/rLR+fB40lhRL8P+KTCTTQtcu:q4qzNp0M/rd+p3t8mKTCTTTu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Nebula.exe
Files
-
Nebula.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 3.8MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 266KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE