nabucur | f7b190f3aa70b843ff02a0be2ed691dc1e0370c7728adbeb987651632a35144c

General

Target
f7b190f3aa70b843ff02a0be2ed691dc1e0370c7728adbeb987651632a35144c
Size 487KB
Sample260828-klpt8avhpb
SHA256 f7b190f3aa70b843ff02a0be2ed691dc1e0370c7728adbeb987651632a35144c
MD5 d284a055f15b6cb9867ee79d370893fa
SHA1 7b487deb68be0ea327ca27789338e9687d2cfeec
SHA512 38916ece6cac17c4f09d94a436e897e68aa2e76d5e4bbd89a75330e6dea7422547d9c3b5fc94d58282abe770f6da065d79286cf5337df8e28911b391ecf1951c
SSDEEP 6144:yXkfbrstDxNUAkxm0gwm31GnhRaLFZyJdSgzfOrVKuBIOjreWb3zytT96FG//li1:1MttNUZm0H9OFKzf22CHQbKZ
TLSH
T144B4F175B613C9B9FE5A94745121308B6CACB6B41F2AE86493A08E749F92CF0CC5C7F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  f7b190f3aa70b843ff02a0be2ed691dc1e0370c7728adbeb987651632a35144c
- Size 487KB
- SHA256 f7b190f3aa70b843ff02a0be2ed691dc1e0370c7728adbeb987651632a35144c
- MD5 d284a055f15b6cb9867ee79d370893fa
- SHA1 7b487deb68be0ea327ca27789338e9687d2cfeec
- SHA512 38916ece6cac17c4f09d94a436e897e68aa2e76d5e4bbd89a75330e6dea7422547d9c3b5fc94d58282abe770f6da065d79286cf5337df8e28911b391ecf1951c
- SSDEEP 6144:yXkfbrstDxNUAkxm0gwm31GnhRaLFZyJdSgzfOrVKuBIOjreWb3zytT96FG//li1:1MttNUZm0H9OFKzf22CHQbKZ
- TLSH
  T144B4F175B613C9B9FE5A94745121308B6CACB6B41F2AE86493A08E749F92CF0CC5C7F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (89) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1