nabucur | 5719815b9e702f22bf12d41029551bb5ef52c7e17aa6c72fda082dd8e7b4a421

General

Target
5719815b9e702f22bf12d41029551bb5ef52c7e17aa6c72fda082dd8e7b4a421
Size 1.6MB
Sample260907-j85zaazzfv
SHA256 5719815b9e702f22bf12d41029551bb5ef52c7e17aa6c72fda082dd8e7b4a421
MD5 eaa824246eaa358d1f4cea206bcf5711
SHA1 a72f56c3a8803aa35570ea4dd461ab385c5526f8
SHA512 c0c14c3a89cb5d5e2305f5a1ff3559dad1a8150f116d9eaf9e593b61926448875cdf9d7a46a85be2689984be488476d4cfd528a1b95f5404f28f2b8e3695a200
SSDEEP 24576:1R0v8XMsrY4EHA4LvATA03vLgnlmMCKf1wiJGkD5yhRRRRRRRRRZ:10SK9wi1E
TLSH
T1A475FC47A31A840A4DE2F433E5E784421C88FA1A5A58DDD23F606E226F8F639715DCF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  5719815b9e702f22bf12d41029551bb5ef52c7e17aa6c72fda082dd8e7b4a421
- Size 1.6MB
- SHA256 5719815b9e702f22bf12d41029551bb5ef52c7e17aa6c72fda082dd8e7b4a421
- MD5 eaa824246eaa358d1f4cea206bcf5711
- SHA1 a72f56c3a8803aa35570ea4dd461ab385c5526f8
- SHA512 c0c14c3a89cb5d5e2305f5a1ff3559dad1a8150f116d9eaf9e593b61926448875cdf9d7a46a85be2689984be488476d4cfd528a1b95f5404f28f2b8e3695a200
- SSDEEP 24576:1R0v8XMsrY4EHA4LvATA03vLgnlmMCKf1wiJGkD5yhRRRRRRRRRZ:10SK9wi1E
- TLSH
  T1A475FC47A31A840A4DE2F433E5E784421C88FA1A5A58DDD23F606E226F8F639715DCF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (161) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1