nabucur | c7a428add79698fab37dbe1dd56044469f476e455e7c82ca995a0184bd7a3b2c

General

Target
2026-06-27_a193027bf3d784d6dc04c3f244dc94f8_elex_virlock
Size 2.2MB
Sample260629-e3pmwsc121
SHA256 c7a428add79698fab37dbe1dd56044469f476e455e7c82ca995a0184bd7a3b2c
MD5 a193027bf3d784d6dc04c3f244dc94f8
SHA1 2fdfe7e75716a4999d092e2db04622eaf6fe21a4
SHA512 ba5378751fe619728ebea60fecf13ce6e096179525af1676bb9dfb5040da6a899296c12a989f0087415718aaba69927f45f4d5cdaf84c74cdbcc15314b8bb98f
SSDEEP 49152:6gQ2OJOMB42l5djN5In6v0pLAYLrsRLV3T8O9HPPehX1KuFuMstMC0Hz/AWglk9X:MjOMn5djN5In6v0pLAYLrsRLV3T8O9Hq
TLSH
T195B58431976B8C65AF4F24D326559BD2FA7012C4CA03BB1D38B6BA7605EC0D84C7E19B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-27_a193027bf3d784d6dc04c3f244dc94f8_elex_virlock
- Size 2.2MB
- SHA256 c7a428add79698fab37dbe1dd56044469f476e455e7c82ca995a0184bd7a3b2c
- MD5 a193027bf3d784d6dc04c3f244dc94f8
- SHA1 2fdfe7e75716a4999d092e2db04622eaf6fe21a4
- SHA512 ba5378751fe619728ebea60fecf13ce6e096179525af1676bb9dfb5040da6a899296c12a989f0087415718aaba69927f45f4d5cdaf84c74cdbcc15314b8bb98f
- SSDEEP 49152:6gQ2OJOMB42l5djN5In6v0pLAYLrsRLV3T8O9HPPehX1KuFuMstMC0Hz/AWglk9X:MjOMn5djN5In6v0pLAYLrsRLV3T8O9Hq
- TLSH
  T195B58431976B8C65AF4F24D326559BD2FA7012C4CA03BB1D38B6BA7605EC0D84C7E19B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (157) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2