nabucur | a37ef4813be45ede6fa8bc9ea075c53fc5aa2caf8dbece6ac8b05bfd2a4242fa

General

Target
2026-06-26_2cde7f1bb18d010e9e2d194efcd199e5_elex_virlock
Size 4.0MB
Sample260629-vss6bsav6s
SHA256 a37ef4813be45ede6fa8bc9ea075c53fc5aa2caf8dbece6ac8b05bfd2a4242fa
MD5 2cde7f1bb18d010e9e2d194efcd199e5
SHA1 35373013cd70996abc2c095ef4a42c47b6d79498
SHA512 ffff26cafff8f5bd35cae283963b08aebb83e5d6486c9b12dde72f8be73c122c30ca4e482c8dd4464fa99b88594aa3bd83c2c60801e46b524f90129c25f75964
SSDEEP 98304:kiiiiii1iiiiiigAkbljdjx50Trz6WyvxTp/Z:kiiiiii1iiiiiiMjdjH0HWWyvj/Z
TLSH
T175169001C869ACE2185E5A03F368193D2A0B31DB2EF217769E5C6E525F7D64F19EF308
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-26_2cde7f1bb18d010e9e2d194efcd199e5_elex_virlock
- Size 4.0MB
- SHA256 a37ef4813be45ede6fa8bc9ea075c53fc5aa2caf8dbece6ac8b05bfd2a4242fa
- MD5 2cde7f1bb18d010e9e2d194efcd199e5
- SHA1 35373013cd70996abc2c095ef4a42c47b6d79498
- SHA512 ffff26cafff8f5bd35cae283963b08aebb83e5d6486c9b12dde72f8be73c122c30ca4e482c8dd4464fa99b88594aa3bd83c2c60801e46b524f90129c25f75964
- SSDEEP 98304:kiiiiii1iiiiiigAkbljdjx50Trz6WyvxTp/Z:kiiiiii1iiiiiiMjdjH0HWWyvj/Z
- TLSH
  T175169001C869ACE2185E5A03F368193D2A0B31DB2EF217769E5C6E525F7D64F19EF308
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery persistence adware defense_evasion nabucur ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Custom signature
  
  Detects executables containing URLs to raw contents of a Github gist
- Custom signature
  
  Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Renames multiple (128) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2