nabucur | 089a8f19f60b8356ab7f93e349941fcab3763a9c5099d6881acbdf2c3fb76a3d

General

Target
2026-07-05_bbe10a1038859532a15bfa79b8eb051d_elex_virlock
Size 200KB
Sample260705-blhlgabw6p
SHA256 089a8f19f60b8356ab7f93e349941fcab3763a9c5099d6881acbdf2c3fb76a3d
MD5 bbe10a1038859532a15bfa79b8eb051d
SHA1 5192832bcabe8516e2d82894da31d48954d3401e
SHA512 bb2702a5c58b965131068a74f7c5ea51c133959144a30d9df0acd9a138255d4c37f611a879e55b63cf894a35a9dea9a4d182d60fdb74283e7c3463011ffacf06
SSDEEP 3072:u9aBvW1TuoPur9uYui59cjxC4dEqksCnDKnfCDiVA/E14XjIGjtXHqBLqz:uiW1TrUk1CnIfi5xIG9oLqz
TLSH
T12D142AAA164979FCCE6FFD73B5241A07F26DAC2327C15F88215D78A0F25D363D6001AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-05_bbe10a1038859532a15bfa79b8eb051d_elex_virlock
- Size 200KB
- SHA256 089a8f19f60b8356ab7f93e349941fcab3763a9c5099d6881acbdf2c3fb76a3d
- MD5 bbe10a1038859532a15bfa79b8eb051d
- SHA1 5192832bcabe8516e2d82894da31d48954d3401e
- SHA512 bb2702a5c58b965131068a74f7c5ea51c133959144a30d9df0acd9a138255d4c37f611a879e55b63cf894a35a9dea9a4d182d60fdb74283e7c3463011ffacf06
- SSDEEP 3072:u9aBvW1TuoPur9uYui59cjxC4dEqksCnDKnfCDiVA/E14XjIGjtXHqBLqz:uiW1TrUk1CnIfi5xIG9oLqz
- TLSH
  T12D142AAA164979FCCE6FFD73B5241A07F26DAC2327C15F88215D78A0F25D363D6001AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery nabucur persistence ransomware spyware stealer trojan adware
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (138) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2