nabucur | 81410a5a8d2da5a2d2eed0ee7e489541e9d8fa97d5d9d135ddba6e66f50eb8a7

General

Target
2026-07-11_eed8bdb93545a20f48ae80b6b18a3af6_elex_virlock
Size 648KB
Sample260711-gdx9vaev91
SHA256 81410a5a8d2da5a2d2eed0ee7e489541e9d8fa97d5d9d135ddba6e66f50eb8a7
MD5 eed8bdb93545a20f48ae80b6b18a3af6
SHA1 5bc17eae9c611969a397860d60f64aaa2ec5f694
SHA512 4f8b15dec0545c496cb609addb39fc9ce637f2616c0a8d700cf8c7fceb44912abe0416e2cd67b0330ca1c88f4e61865c708359023673a2cf15cee7a61f4040b6
SSDEEP 12288:+asuSaKtdZ9XX1GespeMskKmHpv7Crnhi58yyV:Kd/ZZUesAX5mHVmN6O
TLSH
T1EFE4BFB3D4A1E04BB9A331A886CD44C5C1D9D8C46B16CBD19036AEE9F41D2377E12E5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-11_eed8bdb93545a20f48ae80b6b18a3af6_elex_virlock
- Size 648KB
- SHA256 81410a5a8d2da5a2d2eed0ee7e489541e9d8fa97d5d9d135ddba6e66f50eb8a7
- MD5 eed8bdb93545a20f48ae80b6b18a3af6
- SHA1 5bc17eae9c611969a397860d60f64aaa2ec5f694
- SHA512 4f8b15dec0545c496cb609addb39fc9ce637f2616c0a8d700cf8c7fceb44912abe0416e2cd67b0330ca1c88f4e61865c708359023673a2cf15cee7a61f4040b6
- SSDEEP 12288:+asuSaKtdZ9XX1GespeMskKmHpv7Crnhi58yyV:Kd/ZZUesAX5mHVmN6O
- TLSH
  T1EFE4BFB3D4A1E04BB9A331A886CD44C5C1D9D8C46B16CBD19036AEE9F41D2377E12E5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (134) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2