nabucur | 54d54a01c2973cb4000b200b1010c7f57b72f5c9dbab067c31eb8d0c40a9c807

General

Target
2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
Size 1.7MB
Sample260708-nbne7aex3x
SHA256 54d54a01c2973cb4000b200b1010c7f57b72f5c9dbab067c31eb8d0c40a9c807
MD5 9613729da2ab5425492d0ed9b5ea7a30
SHA1 6134b5aad038d11eb8af0e6a757ae467b53cc4f5
SHA512 b1a8858cb71c186f02bc6ddb433d246d5a49bfb07bd2ff8ccd74c37380c4b33f97d3645abd5f2a35c144ae36f2d36d0a49d13bbea9f19c65679dc2c53263acd7
SSDEEP 24576:xXt5eiWeT59sxzZ37ZCnldGJFBjKhDCKrAPY:Tl/OtVCnldGX2DCq
TLSH
T1B885C99F4CB7C68B4C403E48ADF572830615A8A4DDF01A5683FEF47C428B9A2E97395D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-08_9613729da2ab5425492d0ed9b5ea7a30_elex_virlock
- Size 1.7MB
- SHA256 54d54a01c2973cb4000b200b1010c7f57b72f5c9dbab067c31eb8d0c40a9c807
- MD5 9613729da2ab5425492d0ed9b5ea7a30
- SHA1 6134b5aad038d11eb8af0e6a757ae467b53cc4f5
- SHA512 b1a8858cb71c186f02bc6ddb433d246d5a49bfb07bd2ff8ccd74c37380c4b33f97d3645abd5f2a35c144ae36f2d36d0a49d13bbea9f19c65679dc2c53263acd7
- SSDEEP 24576:xXt5eiWeT59sxzZ37ZCnldGJFBjKhDCKrAPY:Tl/OtVCnldGX2DCq
- TLSH
  T1B885C99F4CB7C68B4C403E48ADF572830615A8A4DDF01A5683FEF47C428B9A2E97395D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery nabucur persistence ransomware spyware stealer trojan adware
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (157) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2