nabucur | 933426fab1f2f32e8221d7448b8a87e5bb81d1c9e1faca5b5ea77608f21e5aa3

General

Target
2026-07-08_04142a60c1e97b76502c23cfd7420a55_elex_virlock
Size 1.6MB
Sample260708-xfr4lsgs71
SHA256 933426fab1f2f32e8221d7448b8a87e5bb81d1c9e1faca5b5ea77608f21e5aa3
MD5 04142a60c1e97b76502c23cfd7420a55
SHA1 edb1e3fafbebd6c85df5d3ace60241401b3a6124
SHA512 a042a4944ea81863467ebcb8070994ea40544e81da499176f6d9646e90c2e7e48e4eb6416e03badd863713bb2ded467999220e253c37ee3e59346863425e07c1
SSDEEP 12288:rjZNh7WdLjSQ4JIcF7cYgGIatwrQHXWboS4SHBasIYts:rjZ77McF7PgRairQ04ShasIYi
TLSH
T196759ACD8570F679D4CF7871D2B2717BE208E5E4185AF8922D200A47608E5EF9E86E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-08_04142a60c1e97b76502c23cfd7420a55_elex_virlock
- Size 1.6MB
- SHA256 933426fab1f2f32e8221d7448b8a87e5bb81d1c9e1faca5b5ea77608f21e5aa3
- MD5 04142a60c1e97b76502c23cfd7420a55
- SHA1 edb1e3fafbebd6c85df5d3ace60241401b3a6124
- SHA512 a042a4944ea81863467ebcb8070994ea40544e81da499176f6d9646e90c2e7e48e4eb6416e03badd863713bb2ded467999220e253c37ee3e59346863425e07c1
- SSDEEP 12288:rjZNh7WdLjSQ4JIcF7cYgGIatwrQHXWboS4SHBasIYts:rjZ77McF7PgRairQ04ShasIYi
- TLSH
  T196759ACD8570F679D4CF7871D2B2717BE208E5E4185AF8922D200A47608E5EF9E86E4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery nabucur persistence ransomware spyware stealer trojan adware
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (156) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2