nabucur | 7133ba5b670ca0f9c2b82106117a3831140939145a18ae033f2351165aceb938

General

Target
7133ba5b670ca0f9c2b82106117a3831140939145a18ae033f2351165aceb938
Size 1.6MB
Sample260908-mfl79aeg82
SHA256 7133ba5b670ca0f9c2b82106117a3831140939145a18ae033f2351165aceb938
MD5 871d47728cd5dbb359a9c91a4f302c70
SHA1 d71b11f074b9d4b969fd9e28460e2e395f9d86fc
SHA512 ab83e02f605f08da4d1923e72ef1e3c73bb49d2b28efd2355b5cf1e29789ce8f8ca3ef519c5cd88412d598f2d5b3f310ac2104d2b9b55f4cd216052ff6f5f88b
SSDEEP 49152:3aOTiUP1DuqVgmTMjv0PpUS4f61WdUMoyUD9NVKaVi9VTeDyP2+/yZM1Edhvhdxd:7DuqVgmTMjv0PpUS4f61WdUMoyUD9NVx
TLSH
T1F27598171EA3F021BB409A7AEF4CCFB6C3EC28D2A13CD15598EB7CE9C64E1445B5512A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  7133ba5b670ca0f9c2b82106117a3831140939145a18ae033f2351165aceb938
- Size 1.6MB
- SHA256 7133ba5b670ca0f9c2b82106117a3831140939145a18ae033f2351165aceb938
- MD5 871d47728cd5dbb359a9c91a4f302c70
- SHA1 d71b11f074b9d4b969fd9e28460e2e395f9d86fc
- SHA512 ab83e02f605f08da4d1923e72ef1e3c73bb49d2b28efd2355b5cf1e29789ce8f8ca3ef519c5cd88412d598f2d5b3f310ac2104d2b9b55f4cd216052ff6f5f88b
- SSDEEP 49152:3aOTiUP1DuqVgmTMjv0PpUS4f61WdUMoyUD9NVKaVi9VTeDyP2+/yZM1Edhvhdxd:7DuqVgmTMjv0PpUS4f61WdUMoyUD9NVx
- TLSH
  T1F27598171EA3F021BB409A7AEF4CCFB6C3EC28D2A13CD15598EB7CE9C64E1445B5512A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (176) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1