nabucur | 0a74a59204ba53b1829e0fde57e92b60b299faa78b8f9df76a69f1df3b738355

General

Target
0a74a59204ba53b1829e0fde57e92b60b299faa78b8f9df76a69f1df3b738355
Size 1.6MB
Sample260903-rssm1syfqf
SHA256 0a74a59204ba53b1829e0fde57e92b60b299faa78b8f9df76a69f1df3b738355
MD5 8a2a3d83fc0405886716052d792fa6b1
SHA1 c48c987cb762bbcc471b674d3535b6b45049a6a3
SHA512 748b53933b6f4e766f25fc81aa907a4caa478d7a6993df32dcbaa422815445a232246b583e6fc7e3096666fb853e319c0a132bd0a2b710a066df506ef3ba3b42
SSDEEP 24576:c/yaEEEEEEH3yAttNcBE5ToyGsosadaxZgKsyJGp8e:gyaEEEEEEv5EiYCvoX
TLSH
T1B375A9C8BC36FDA1E46568BBFCF686E360548E744051DACCB8AD52A84F4BA16F1405FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  0a74a59204ba53b1829e0fde57e92b60b299faa78b8f9df76a69f1df3b738355
- Size 1.6MB
- SHA256 0a74a59204ba53b1829e0fde57e92b60b299faa78b8f9df76a69f1df3b738355
- MD5 8a2a3d83fc0405886716052d792fa6b1
- SHA1 c48c987cb762bbcc471b674d3535b6b45049a6a3
- SHA512 748b53933b6f4e766f25fc81aa907a4caa478d7a6993df32dcbaa422815445a232246b583e6fc7e3096666fb853e319c0a132bd0a2b710a066df506ef3ba3b42
- SSDEEP 24576:c/yaEEEEEEH3yAttNcBE5ToyGsosadaxZgKsyJGp8e:gyaEEEEEEv5EiYCvoX
- TLSH
  T1B375A9C8BC36FDA1E46568BBFCF686E360548E744051DACCB8AD52A84F4BA16F1405FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (117) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1