nabucur | 5bf8e4c36657294e29b07995fe37fcd9afd8e0c62b3093e1b1846bc714405dc7

General

Target
5bf8e4c36657294e29b07995fe37fcd9afd8e0c62b3093e1b1846bc714405dc7
Size 1.6MB
Sample260908-hsstcadf65
SHA256 5bf8e4c36657294e29b07995fe37fcd9afd8e0c62b3093e1b1846bc714405dc7
MD5 dc917e4f35c9da58a5e3c707b17cdb7a
SHA1 10ecbfb798a62c2461db72b23825e891c2017791
SHA512 d89bc803d6e42556506b7c1439952c56da0a641245ad13fcbee5e80f10c9ffba24f05ffc5dc9e8b06000e6df76fa44fdda4de52406b88db2e009b9fed783f171
SSDEEP 12288:/d0zud+sTuW6tovK+VIOcT16hzOcHsZI1V95k65ZlYnhyl3v81cFqRI:/UVsQtoy+FcT1WzOcHUIvpSo0zRI
TLSH
T1B275878EEC067A61D7E05B23D2BEA07F0E55D45A1A8E1E783603845D1D6B20F81FCDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  5bf8e4c36657294e29b07995fe37fcd9afd8e0c62b3093e1b1846bc714405dc7
- Size 1.6MB
- SHA256 5bf8e4c36657294e29b07995fe37fcd9afd8e0c62b3093e1b1846bc714405dc7
- MD5 dc917e4f35c9da58a5e3c707b17cdb7a
- SHA1 10ecbfb798a62c2461db72b23825e891c2017791
- SHA512 d89bc803d6e42556506b7c1439952c56da0a641245ad13fcbee5e80f10c9ffba24f05ffc5dc9e8b06000e6df76fa44fdda4de52406b88db2e009b9fed783f171
- SSDEEP 12288:/d0zud+sTuW6tovK+VIOcT16hzOcHsZI1V95k65ZlYnhyl3v81cFqRI:/UVsQtoy+FcT1WzOcHUIvpSo0zRI
- TLSH
  T1B275878EEC067A61D7E05B23D2BEA07F0E55D45A1A8E1E783603845D1D6B20F81FCDAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (142) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1