nabucur | 3174d46672af750971347e84b608b394adad64786fd12fc6532d12a30cc19daf

General

Target
3174d46672af750971347e84b608b394adad64786fd12fc6532d12a30cc19daf
Size 1.7MB
Sample260910-peyk1abq61
SHA256 3174d46672af750971347e84b608b394adad64786fd12fc6532d12a30cc19daf
MD5 e38982d5bacba75da3d0a4ccbeb557c8
SHA1 860115c8114144ccc924a1a20dadd298a1f95db1
SHA512 17dfe26fb71a5f6c5c344823affbbd3df72daa33f509e4f9f6007b0a289d0ba30defad1edce2f19fa43d4c92efeba8bd103f5bda1812f66858cd5ec43ecf2a60
SSDEEP 12288:TNQ7ya3b7Ru5h8/OD+SZmedCxGllEgTRdsCs3xWvtRFPZZtcLlYdSRjCC1RfJG+h:TNhaU50OOuJJEC0AjQweP
TLSH
T1A385439FA0A9DF1EF6C1F65036C45076238C625D3405A9CECAD90DBB07A30D1859EDBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  3174d46672af750971347e84b608b394adad64786fd12fc6532d12a30cc19daf
- Size 1.7MB
- SHA256 3174d46672af750971347e84b608b394adad64786fd12fc6532d12a30cc19daf
- MD5 e38982d5bacba75da3d0a4ccbeb557c8
- SHA1 860115c8114144ccc924a1a20dadd298a1f95db1
- SHA512 17dfe26fb71a5f6c5c344823affbbd3df72daa33f509e4f9f6007b0a289d0ba30defad1edce2f19fa43d4c92efeba8bd103f5bda1812f66858cd5ec43ecf2a60
- SSDEEP 12288:TNQ7ya3b7Ru5h8/OD+SZmedCxGllEgTRdsCs3xWvtRFPZZtcLlYdSRjCC1RfJG+h:TNhaU50OOuJJEC0AjQweP
- TLSH
  T1A385439FA0A9DF1EF6C1F65036C45076238C625D3405A9CECAD90DBB07A30D1859EDBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (144) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1