nabucur | ee42e4afa252cf2c95446f34f414bd07f967e21ac1577a2f43b6ee2d078f3434

General

Target
2026-04-19_82336125a2d4cfa7dab8cb6377fa2b62_elex_virlock
Size 2.2MB
Sample260419-vgfe4ae12j
SHA256 ee42e4afa252cf2c95446f34f414bd07f967e21ac1577a2f43b6ee2d078f3434
MD5 82336125a2d4cfa7dab8cb6377fa2b62
SHA1 e3e9d0842da257ed44817e98706b5f2f0e00bcc0
SHA512 eae751a045d7526f104a64428b72d0cc90dbaf6b65456de1b4a6a1496d62795e46ca94a44d53635149b5460e3122167a97711d6d5b0de1290c98c3cb60fbb5b1
SSDEEP 24576:jTm77KSIFjFZcTuAOAsiW1S1vlJwfrLnh0BO8Ar1ZEdknUyG2oFrXLgJa:aAXeOAsiW1S1vlJwLnh0c8AZZIknF
TLSH
T1CEA5509F7DB6070E6781666C0DEA52C247765603C201DACADF6A76384E2A3CE7127337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-19_82336125a2d4cfa7dab8cb6377fa2b62_elex_virlock
- Size 2.2MB
- SHA256 ee42e4afa252cf2c95446f34f414bd07f967e21ac1577a2f43b6ee2d078f3434
- MD5 82336125a2d4cfa7dab8cb6377fa2b62
- SHA1 e3e9d0842da257ed44817e98706b5f2f0e00bcc0
- SHA512 eae751a045d7526f104a64428b72d0cc90dbaf6b65456de1b4a6a1496d62795e46ca94a44d53635149b5460e3122167a97711d6d5b0de1290c98c3cb60fbb5b1
- SSDEEP 24576:jTm77KSIFjFZcTuAOAsiW1S1vlJwfrLnh0BO8Ar1ZEdknUyG2oFrXLgJa:aAXeOAsiW1S1vlJwLnh0c8AZZIknF
- TLSH
  T1CEA5509F7DB6070E6781666C0DEA52C247765603C201DACADF6A76384E2A3CE7127337
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (128) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2