nabucur | 8fda1c8f6875b4ce1e16e38a45ad6cf372ce3c9802b2f3804c7ad23885d57324

General

Target
2026-06-30_b89b80575f87958d2e113a6023e91956_elex_virlock
Size 1.6MB
Sample260701-dn5vwse17s
SHA256 8fda1c8f6875b4ce1e16e38a45ad6cf372ce3c9802b2f3804c7ad23885d57324
MD5 b89b80575f87958d2e113a6023e91956
SHA1 8d5a5b0026e548764f5a333fa5f0d50b6d5ef953
SHA512 718481f484541457fca6cb341dfecfd378a291f72ae3478f0d0e7e4b0ce00a974be010f327c798e6c0e2f9f96848a366d385bc7ce37346bee0db603cfeef4a0b
SSDEEP 12288:J+VWYnVdvitPS3Sim3N7JNC5jxu7sFLfQcd0pMHjLnXmUNjM4kN/1tphXXYBUTvX:J+VWYn3NCP3tCPeIpk1fcpJF4c4wAN
TLSH
T1C07588C248E0FA66C3F79811768542E448FA75D81175CCAE9B11263DA9207EECE13BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-30_b89b80575f87958d2e113a6023e91956_elex_virlock
- Size 1.6MB
- SHA256 8fda1c8f6875b4ce1e16e38a45ad6cf372ce3c9802b2f3804c7ad23885d57324
- MD5 b89b80575f87958d2e113a6023e91956
- SHA1 8d5a5b0026e548764f5a333fa5f0d50b6d5ef953
- SHA512 718481f484541457fca6cb341dfecfd378a291f72ae3478f0d0e7e4b0ce00a974be010f327c798e6c0e2f9f96848a366d385bc7ce37346bee0db603cfeef4a0b
- SSDEEP 12288:J+VWYnVdvitPS3Sim3N7JNC5jxu7sFLfQcd0pMHjLnXmUNjM4kN/1tphXXYBUTvX:J+VWYn3NCP3tCPeIpk1fcpJF4c4wAN
- TLSH
  T1C07588C248E0FA66C3F79811768542E448FA75D81175CCAE9B11263DA9207EECE13BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery nabucur persistence ransomware spyware stealer trojan adware
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (143) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2