nabucur | 35b6a3066ac50f8a93b834468ab9ef8e7d236e45dea287120d9ce7033d880a8b

General

Target
35b6a3066ac50f8a93b834468ab9ef8e7d236e45dea287120d9ce7033d880a8b
Size 558KB
Sample260903-nc4tkawbnf
SHA256 35b6a3066ac50f8a93b834468ab9ef8e7d236e45dea287120d9ce7033d880a8b
MD5 e4b5205f3919f4686071e1772833f96c
SHA1 deedca2d196333972b50609afca447c259f2bb5e
SHA512 b2f0f7698a3816eac54c6614adfdc54df057361db62ca55dec23976b59f06e9b4d84fdf921de3bd8812b1066312ed674b5c6b84e00aa77cd80365d28239c1b0c
SSDEEP 12288:0zmQ+zyySHKh1ql9wjJXxjf4DqfjAJRA1f/qYHN/DL+:z3yyFhQbwFxjf4DqLA7A5ycN/DL
TLSH
T195C4013A72218C9FEEB964FEB91E12279B7000E9DD2476C905643D44EC7B2D79A1DC32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  35b6a3066ac50f8a93b834468ab9ef8e7d236e45dea287120d9ce7033d880a8b
- Size 558KB
- SHA256 35b6a3066ac50f8a93b834468ab9ef8e7d236e45dea287120d9ce7033d880a8b
- MD5 e4b5205f3919f4686071e1772833f96c
- SHA1 deedca2d196333972b50609afca447c259f2bb5e
- SHA512 b2f0f7698a3816eac54c6614adfdc54df057361db62ca55dec23976b59f06e9b4d84fdf921de3bd8812b1066312ed674b5c6b84e00aa77cd80365d28239c1b0c
- SSDEEP 12288:0zmQ+zyySHKh1ql9wjJXxjf4DqfjAJRA1f/qYHN/DL+:z3yyFhQbwFxjf4DqLA7A5ycN/DL
- TLSH
  T195C4013A72218C9FEEB964FEB91E12279B7000E9DD2476C905643D44EC7B2D79A1DC32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (118) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1