nabucur | 3ca8636db120dc058c45a4f30969c73fb3beda4e845f94d75e541899c03bf9a9

General

Target
2026-04-20_e5b57435257103188f0d7dd1a20c7414_elex_virlock
Size 625KB
Sample260420-bp95wsbs2t
SHA256 3ca8636db120dc058c45a4f30969c73fb3beda4e845f94d75e541899c03bf9a9
MD5 e5b57435257103188f0d7dd1a20c7414
SHA1 7b05ea7787a75ea8fd69c853261bcc8439f24d85
SHA512 63d195622314c9115c49e34cbdf13cc7f135ab172a49b4a4471b25ab0b09cdf7a298d5020eb015abfb23687b158f2860f004ab115acffb6cf34e1564537c60a9
SSDEEP 12288:Om3CriyGm768TvbhXROIioP2DIMGbr95tvOIyYkM6bB+9pGjysaqfRFfpaGmdK88:JxeF8IioP2DIMGbrLtvIYB6F+981Fha3
TLSH
T11ED4CF22E70E8A57CC84AB7A019C2B47D292861ADBD3D05EDA177DC6D35F180583E7B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-20_e5b57435257103188f0d7dd1a20c7414_elex_virlock
- Size 625KB
- SHA256 3ca8636db120dc058c45a4f30969c73fb3beda4e845f94d75e541899c03bf9a9
- MD5 e5b57435257103188f0d7dd1a20c7414
- SHA1 7b05ea7787a75ea8fd69c853261bcc8439f24d85
- SHA512 63d195622314c9115c49e34cbdf13cc7f135ab172a49b4a4471b25ab0b09cdf7a298d5020eb015abfb23687b158f2860f004ab115acffb6cf34e1564537c60a9
- SSDEEP 12288:Om3CriyGm768TvbhXROIioP2DIMGbr95tvOIyYkM6bB+9pGjysaqfRFfpaGmdK88:JxeF8IioP2DIMGbrLtvIYB6F+981Fha3
- TLSH
  T11ED4CF22E70E8A57CC84AB7A019C2B47D292861ADBD3D05EDA177DC6D35F180583E7B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (153) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2