nabucur | b9df5b15af55450ebdbcdc72da2d95b04ac35eb758f837a3a3449d5f965a9ec1

General

Target
b9df5b15af55450ebdbcdc72da2d95b04ac35eb758f837a3a3449d5f965a9ec1
Size 1.1MB
Sample260827-t2avnsbm71
SHA256 b9df5b15af55450ebdbcdc72da2d95b04ac35eb758f837a3a3449d5f965a9ec1
MD5 9d5ac36595c2171aaedae462abc268f2
SHA1 ada1385d37e807dd7c814f95246914903fb41d66
SHA512 5345472f80efa985e3d399b69c1b6d75e4eb23bcea91398125dac0a3c91167b6d3aaf3d5c74b12d5c7f1868349f2213fef954f5d7a49e7f8ec204e2067134be1
SSDEEP 12288:kKKFBdgxy9At8+0+P8r+JHtxxDYv43bU7HM:oFvgxy9AyNVqtxxDYAroHM
TLSH
T1CA35AD42B83DF612FC067879CFCD969AAC8BDA028BF908AD54D11521D4BA1D09FDB137
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  b9df5b15af55450ebdbcdc72da2d95b04ac35eb758f837a3a3449d5f965a9ec1
- Size 1.1MB
- SHA256 b9df5b15af55450ebdbcdc72da2d95b04ac35eb758f837a3a3449d5f965a9ec1
- MD5 9d5ac36595c2171aaedae462abc268f2
- SHA1 ada1385d37e807dd7c814f95246914903fb41d66
- SHA512 5345472f80efa985e3d399b69c1b6d75e4eb23bcea91398125dac0a3c91167b6d3aaf3d5c74b12d5c7f1868349f2213fef954f5d7a49e7f8ec204e2067134be1
- SSDEEP 12288:kKKFBdgxy9At8+0+P8r+JHtxxDYv43bU7HM:oFvgxy9AyNVqtxxDYAroHM
- TLSH
  T1CA35AD42B83DF612FC067879CFCD969AAC8BDA028BF908AD54D11521D4BA1D09FDB137
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (143) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1