nabucur | 90a80e6df9f54ccaaf2a6e8337a9f47491f28102cb6775a633ca2811edd1983c

General

Target
90a80e6df9f54ccaaf2a6e8337a9f47491f28102cb6775a633ca2811edd1983c
Size 444KB
Sample260826-kshdqace34
SHA256 90a80e6df9f54ccaaf2a6e8337a9f47491f28102cb6775a633ca2811edd1983c
MD5 c1bcdc227ac9c9cc03011bcfbae3f0e2
SHA1 47f5d4647a22d8236fc30b7f6224485c28b707cb
SHA512 2bf02574d0bd601cf6ac1c9e16587b1aee98a967e2eb3ac84d0f52707c7a5a5c181d74eb8f19d6044fa3d2ac1af25bed39f7eb5c873bf64fd1573313f866150f
SSDEEP 12288:+bVJ7k5MYrEhLxCCe12IOIXjFKNj8Q8w0JbKV:MJ7k53rEhLgCe1pp5UjOJbm
TLSH
T136A401888F777D80FBE67B74629D8F2A447585B6349D22362952633CC392BBC49CCE14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  90a80e6df9f54ccaaf2a6e8337a9f47491f28102cb6775a633ca2811edd1983c
- Size 444KB
- SHA256 90a80e6df9f54ccaaf2a6e8337a9f47491f28102cb6775a633ca2811edd1983c
- MD5 c1bcdc227ac9c9cc03011bcfbae3f0e2
- SHA1 47f5d4647a22d8236fc30b7f6224485c28b707cb
- SHA512 2bf02574d0bd601cf6ac1c9e16587b1aee98a967e2eb3ac84d0f52707c7a5a5c181d74eb8f19d6044fa3d2ac1af25bed39f7eb5c873bf64fd1573313f866150f
- SSDEEP 12288:+bVJ7k5MYrEhLxCCe12IOIXjFKNj8Q8w0JbKV:MJ7k53rEhLgCe1pp5UjOJbm
- TLSH
  T136A401888F777D80FBE67B74629D8F2A447585B6349D22362952633CC392BBC49CCE14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (107) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1