nabucur | 365fda0c0d5a48c0cd8f081a86045260a4ac0e594d7192d769593a6963dad9bf

General

Target
2026-08-08_7e240f8cab81c315feacb1f8a1838682_elex_virlock
Size 278KB
Sample260808-2pt2sawbmb
SHA256 365fda0c0d5a48c0cd8f081a86045260a4ac0e594d7192d769593a6963dad9bf
MD5 7e240f8cab81c315feacb1f8a1838682
SHA1 2fafd4e42f2a8dd4051da1d62590efabe0c067e6
SHA512 2e8b8bc8723a26272b17b08a681e437d352a79bf3dc792c908bc6a8392f4f0d10a989613a0d6560d7c693afe856129a60e326d362af3111a08e14f7223ca5403
SSDEEP 3072:b/UmxqDu6nc3lVA6w/1jNt1NEeiHjXdX45WnHJoKlBdrp4DD2eoXqjjFKc6UsT5A:1Vw6K5REfjXWaPlx4jFKUs19Hp9G
TLSH
T12E548C7E4FC7575DDB7EA56820434119800A7BC3BA74EDBEA75B8F8D500528332AF268
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_7e240f8cab81c315feacb1f8a1838682_elex_virlock
- Size 278KB
- SHA256 365fda0c0d5a48c0cd8f081a86045260a4ac0e594d7192d769593a6963dad9bf
- MD5 7e240f8cab81c315feacb1f8a1838682
- SHA1 2fafd4e42f2a8dd4051da1d62590efabe0c067e6
- SHA512 2e8b8bc8723a26272b17b08a681e437d352a79bf3dc792c908bc6a8392f4f0d10a989613a0d6560d7c693afe856129a60e326d362af3111a08e14f7223ca5403
- SSDEEP 3072:b/UmxqDu6nc3lVA6w/1jNt1NEeiHjXdX45WnHJoKlBdrp4DD2eoXqjjFKc6UsT5A:1Vw6K5REfjXWaPlx4jFKUs19Hp9G
- TLSH
  T12E548C7E4FC7575DDB7EA56820434119800A7BC3BA74EDBEA75B8F8D500528332AF268
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (134) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2