8bd97b64e5038ea4c80bd14606e3a4cf61e5ab0842b91ca605fb4706dafce310

Sharing

Copy URL Twitter E-mail

General

Target
Nebula.rar
Size 91.2MB
Sample260730-prbxrsam9w
SHA256 8bd97b64e5038ea4c80bd14606e3a4cf61e5ab0842b91ca605fb4706dafce310
MD5 f8bce0794d5c2b3775728cc920a00bb3
SHA1 3a9b6033c3bc5c9dc1eab1415b2ca4082f40f6b9
SHA512 063782e80deef7964d3d34f9f9a2fbb289c839d7f3f598b48b41080a27cda34f9d6746241a9edbf05a77d9721fcca4a8422f11786c63ede08834495acdf3a3d4
SSDEEP 1572864:+GPa5sybariNs3+DsMvSeAplbvg96NS7nqPl9JuAsXh2cG1G8mD/GtZ:+GPjwNscsoSvMOS7qP3JG2cG1oe
TLSH
T11D28338A181D8CCA9AA9F7B470507DFCDDEB34E53C9EF1D082D14136BEFA90454DA21A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Nebula.rar
- Size 91.2MB
- SHA256 8bd97b64e5038ea4c80bd14606e3a4cf61e5ab0842b91ca605fb4706dafce310
- MD5 f8bce0794d5c2b3775728cc920a00bb3
- SHA1 3a9b6033c3bc5c9dc1eab1415b2ca4082f40f6b9
- SHA512 063782e80deef7964d3d34f9f9a2fbb289c839d7f3f598b48b41080a27cda34f9d6746241a9edbf05a77d9721fcca4a8422f11786c63ede08834495acdf3a3d4
- SSDEEP 1572864:+GPa5sybariNs3+DsMvSeAplbvg96NS7nqPl9JuAsXh2cG1G8mD/GtZ:+GPjwNscsoSvMOS7qP3JG2cG1oe
- TLSH
  T11D28338A181D8CCA9AA9F7B470507DFCDDEB34E53C9EF1D082D14136BEFA90454DA21A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1 behavioral2
- Target
  Nebula/Api/Injector.exe
- Size 55KB
- SHA256 8072938a42757db90032185c4890b011123da399c2505a7667a596126ebe9a89
- MD5 6e41e128fd91931933f0e24045e32d51
- SHA1 22c0279ecec323e0833f1385541ddeba1b57e66c
- SHA512 610040a1237aa867276b81e7c6e6d2a1ac0ce3af2db0d264c0722e76508f984e73056d60fed2b48ed8ac32c38500d61816ec25f9f8b30b4f9adc76244690cfde
- SSDEEP 768:yXDwG2y1xWFnADrJW8X2zKGx/olP5aP3B0Gt7BHlRR5HPjYd3vEueE:yzwGPrJW86bx8PMPeGpZR5vTE
- TLSH
  T1E0434C53EB6804ECE07AD3BDD6A78B86EB72F406032157CF0750921A0F1B9D56D7EA11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Nebula/Api/Module.dll
- Size 51.6MB
- SHA256 5386e6c997c9f1d82a58c33c298ebb32dd779742afe9c505756c02982bcf3dfc
- MD5 a207ff0b8029ae803065f00e50243b7c
- SHA1 fa7bf9e36ad694faad15368be0eac01e57e25761
- SHA512 02031d4c6bccd94d1e3b62bca10fec1d859c2478b7b91d5f16dc56c781d3575a4c54a1bcc8301dffc2990064badbdee6997ddfb3d0b99c12039089a7d1d54784
- SSDEEP 786432:63mUtYhDJnJr99jrybWd1gMgCjK37sJX9ctxjXD97hAz7d00KsTXRb0m9Avd:thtnJr9w5v374XmtxjT9ezR00PTXVud
- TLSH
  T193C702DE79E45686C2BFE1B6C643141BC3B064981AE42B9D41B143D62BB3BFD246F348
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Nebula/Microsoft.Web.WebView2.Core.dll
- Size 897KB
- SHA256 e03bb5fe022c17dd44a34a7a5c4475bf62b2ff0f3bb9d9c6a38bbedbef2d1970
- MD5 025adf22f6ba12da9b2297f4aca60f01
- SHA1 a6c7c7e6a97cf2ea5c9eff2882a44bf84118de5c
- SHA512 0e37aee41a1ebee8969e903c7adc821a4b5273aa3a85df3774b0d5af676c39a02cfae377ec54d0bfe4ef9f62ed48134bf26b42c4f55b5d7d2c152b4d02d49660
- SSDEEP 12288:256C3UF+oSvR2AiuvrPt5IE3zFI26JQm+M+iA81hKmYVDRQMuzXRFXTSONZvgMU5:256CFu9cD
- TLSH
  T107152D1233FD461DF5F67F75597426649BBABCA6BA78C28D0298506E0C72F8099B0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Nebula/Microsoft.Web.WebView2.WinForms.dll
- Size 37KB
- SHA256 1756a7c3bb7120248107060dc71ad261d9a78e0844d82c24f539fceb17f2a5de
- MD5 20d17fc2536358248a0c89f1b02ab542
- SHA1 d6e79d162dce09f6bc60cfb7b2be49408f7bd7a4
- SHA512 97fc9c459137820ffdc9a46ff8977ebeabf09955c1fccb40ea2165fc6bb25fcbd5d783c2eaa4da591570274ce4e8d0b490cd44a3cd359ab56c7142f431743beb
- SSDEEP 768:VQNb2vIYymJK2Mss+5NQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSxKD:ub2vnbNQ+ZDgcEST3p4JjrjaeFSUyauV
- TLSH
  T16E034C0087ACC517E6EB6F78B9B4916107BABEC37DA1D3A90D84B1DA0C73BD055143AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Nebula/Microsoft.Web.WebView2.Wpf.dll
- Size 81KB
- SHA256 c2054d668fc3b1f49915ba928550241038627150dc7624aff86c3f76b0f3eb84
- MD5 c260bf7dbeb3caaff3e844c011e52a82
- SHA1 0f7b0970de45df4b6ffa27b45b3f0bbf4c0f940d
- SHA512 d14b819f4f3f7102617ef811ba926042db80d4de01264c7b453b041522b3511cb0dbe58923a72eb27ecb5494878fad67b17defb47904468189342699446030f2
- SSDEEP 1536:78cylyO/wL8OYNmc1d6mWuuoh68sYyDHfy7yEW30bfc4JAyr4YeUq2HhxU0udtlO:AcylyO/ZOGm2dSI68uDHfyy30bfc4JA6
- TLSH
  T112835C9053BC8823D6FF1FBD786111650BF9EE83BA92D3992984B1EC0CA37D02915767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Nebula/Nebula.exe
- Size 880KB
- SHA256 6671967fc21b2af285032dc00260ecfa861611ff55ab35cbfc0d69a004701830
- MD5 011b548f1e708a571305e464a301be63
- SHA1 57617446421c6f24a06214396b1709ce6ca91487
- SHA512 c538d76129f1191a5f680844c5392dce7ff9717e7b0507227d6a8de499f4b0c5283434ae0be39d21bccce7360a3a67487c4a05f6f77cc1eb4f34597825e54fe9
- SSDEEP 12288:nYHIh5ipgVH7hipLvfzPO38eBtbU0vozS7gOIxd3mEaKRvynqZmFxjeckIVOhP5n:nYHDuH7EpLvfzW8eBBUd2CdWwRk/zFA
- TLSH
  T14F15F1D8B610B6EEC82BD572CDA96D74AB607C36170B4143A05736AE993D8C3CF141FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral13 behavioral14
- Target
  f_00000b
- Size 870KB
- SHA256 c9fc8d435c9c3e131d7aedb36923a5ef798c85412192ed2afd9c52dcfb826ff7
- MD5 a07ac1bf3466fe5eff6b753f96f39a11
- SHA1 d06f6ebd81a8c180a7a6343821a3cf8279f5b86d
- SHA512 4648746112b8cdbab787c43e88827d96e02034c52b5436167a24d647ce349a0501df4ca67f82779c89fe0f5659bcc9b444655f83da816469c23e781fa3facc9a
- SSDEEP 12288:CN7INAse6Zz779FTMfCtfTSZDYDzVRlh09yENpDvE:a0le6p5tfTSZ0D1h09yENpDvE
- TLSH
  T150153ADE714639B24322B6F52077241EA77E9619C40C5C5D70AA98F03EF580DA0F6EBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  f_000010
- Size 300KB
- SHA256 0f5e933d514bac9b3aedb577894bd99ef59f68d4867f152c1fe9a87de63e6ddc
- MD5 0b21ecadf949dc174ea80d42c214ebcd
- SHA1 796a8dc63ab19c9e8e2c91fb7cee350fcc639c7c
- SHA512 171a96ef881b884df0677749c79749f2d79c0842ca7bdad3da31bda6b8591a3bf4f42368b8b40148786b3828a8bdde8ba2d4b211dc0f18dba9516f3e6250ab3a
- SSDEEP 3072:iGp0TPFCVbGozyhoU+dSuo32aQmwfQmYG:NaTFCVa3qUsSZ32lQmT
- TLSH
  T13D6428CDB291B03C5387B17051BF110BB77D3A1404AC84A8BE6DD4DA6B6464CA67BBF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  f_000014
- Size 870KB
- SHA256 c9fc8d435c9c3e131d7aedb36923a5ef798c85412192ed2afd9c52dcfb826ff7
- MD5 a07ac1bf3466fe5eff6b753f96f39a11
- SHA1 d06f6ebd81a8c180a7a6343821a3cf8279f5b86d
- SHA512 4648746112b8cdbab787c43e88827d96e02034c52b5436167a24d647ce349a0501df4ca67f82779c89fe0f5659bcc9b444655f83da816469c23e781fa3facc9a
- SSDEEP 12288:CN7INAse6Zz779FTMfCtfTSZDYDzVRlh09yENpDvE:a0le6p5tfTSZ0D1h09yENpDvE
- TLSH
  T150153ADE714639B24322B6F52077241EA77E9619C40C5C5D70AA98F03EF580DA0F6EBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Nebula/Nebula.exe.WebView2/EBWebView/Speech Recognition/1.15.0.1/Microsoft.CognitiveServices.Speech.core.dll
- Size 2.6MB
- SHA256 62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e
- MD5 0ee2b50c85a110689352fccfa77b5b18
- SHA1 d9ecc4b12d2d50e3cbce40e75edad804c9988b25
- SHA512 a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff
- SSDEEP 49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl
- TLSH
  T188C54C1FA64951E6C07AD138C543550BE2B27C60CB7263CB1BA7038A1FA37E2557FB92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Nebula/Nebula.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.84/adblock_snippet.js
- Size 2KB
- SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
- MD5 f5c93c471485f4b9ab45260518c30267
- SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
- SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
- TLSH
  T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Nebula/Nebula.exe.WebView2/EBWebView/WidevineCdm/4.10.3050.1/_platform_specific/win_x64/widevinecdm.dll
- Size 21.6MB
- SHA256 fbb1e66a39c6f502a97a55188b25d3b102341ff6bc49c4c37ab6ef48305650ed
- MD5 7e131636ead898275d2ac7841a3d94fd
- SHA1 5fe13b2a84160094cfc2bbc56d8788c097bcd819
- SHA512 6f00e7f8e07c9c78fefef7e31fb02b0c7da5cb7efde6d50da54ba26048a8dc7f6dbacff1d9a14a80ce8e6ed02005c5887d491a832c1e9618886949e920b38161
- SSDEEP 393216:NYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoH4:EmghF5QDwWCm/2YU8Ivq9u5B
- TLSH
  T1F437F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  adblock_snippet.js
- Size 2KB
- SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
- MD5 f5c93c471485f4b9ab45260518c30267
- SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
- SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
- TLSH
  T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  _platform_specific/win_x64/widevinecdm.dll
- Size 21.6MB
- SHA256 fbb1e66a39c6f502a97a55188b25d3b102341ff6bc49c4c37ab6ef48305650ed
- MD5 7e131636ead898275d2ac7841a3d94fd
- SHA1 5fe13b2a84160094cfc2bbc56d8788c097bcd819
- SHA512 6f00e7f8e07c9c78fefef7e31fb02b0c7da5cb7efde6d50da54ba26048a8dc7f6dbacff1d9a14a80ce8e6ed02005c5887d491a832c1e9618886949e920b38161
- SSDEEP 393216:NYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoH4:EmghF5QDwWCm/2YU8Ivq9u5B
- TLSH
  T1F437F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  Nebula/monaco/editor.html
- Size 44KB
- SHA256 9a114e18895ec4342691f26dd9083405adaa8f60fd727cac433c9f2c5cca734a
- MD5 89b7166a2ec4ed43e4bf56416a8daf00
- SHA1 edef0b1aa0d733fedf30af6869bb7268d5b6ccca
- SHA512 936603d1562db3632ab98ccb6d6238456e6a19a02f13ef79dc4673b5bf4c6ca945a91a928842fc9422f9ff17c685217ee1fdc070fd42d6e1fd0699a7d964a840
- SSDEEP 768:BwncmblKS7FIOiqHxTzAIDdr/Ha5BooWcRJZVZJuepmLKumh7LqZzhB2OdXdH27v:mZlKS7FIOiqHxTzAIDdr/Ha5BooFRJZv
- TLSH
  T17F23A6EE302B6C046691C3B9834773055AB982B7E9F27520BB4E36119F9D20F91B726D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  Nebula/runtimes/win-arm64/native/WebView2Loader.dll
- Size 147KB
- SHA256 6fcb1c3fb95f350c3e5de0ede7dda94ce630f60699606a932c1f701fe4728542
- MD5 42daf6cda9830541da3f2de4e54aacb4
- SHA1 ef29c61b893c2ac034fe2495e20c2a25b2614270
- SHA512 01a86afaf9f5ec26618dd29e176cfaa8071908e238382e6c41cd3a91c8f67bf6b34c3654be897580c66983bd3025893c1887270c6260015e138440332ff89ecb
- SSDEEP 3072:BuUEtKBPDFhOcaG9GQqJAyT/nLneEtJt3BCwWTUt:X7bF1gLnSEtJtBCHE
- TLSH
  T156E31A9367DD1843E6D6E73CCC678950273BFA788930C95A6152020EDE1FBC1DEB4A22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

Drops desktop.ini file(s)

Network Share Discovery

ConfuserEx .NET packer

Checks whether UAC is enabled

Drops desktop.ini file(s)

Network Share Discovery

ConfuserEx .NET packer

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32