nabucur | 5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d

General

Target
5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d
Size 606KB
Sample260910-xvwqcaxtdv
SHA256 5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d
MD5 bb9df20760886b52f499ea1c5023d45b
SHA1 17b2bdaf0da289b4163b62958c59e30c965dfac5
SHA512 fd3c83096dd92e88376362b49f7996889abec0c28d4b77aafccc85a8e6ac9a7759045f3de76af521a97dbcecaad9a0320f35e44816b6c8e3f9c56b7bddaf80f3
SSDEEP 12288:hjgdeOsZyHoeDsfjOfJqb2pcOH5zgFn/1h//c017NUMlZrMwQUM:+nAwJO2hKl/11n7NbMU
TLSH
T1F6D4F1AD12190593CC56D3775F3A4ECE2B348344ACFA70C5EBA9D13B92AE220393D5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d
- Size 606KB
- SHA256 5764a780c20493fe9b90f19e638bad3d2803b978f0a9456f8b057bdfdf20760d
- MD5 bb9df20760886b52f499ea1c5023d45b
- SHA1 17b2bdaf0da289b4163b62958c59e30c965dfac5
- SHA512 fd3c83096dd92e88376362b49f7996889abec0c28d4b77aafccc85a8e6ac9a7759045f3de76af521a97dbcecaad9a0320f35e44816b6c8e3f9c56b7bddaf80f3
- SSDEEP 12288:hjgdeOsZyHoeDsfjOfJqb2pcOH5zgFn/1h//c017NUMlZrMwQUM:+nAwJO2hKl/11n7NbMU
- TLSH
  T1F6D4F1AD12190593CC56D3775F3A4ECE2B348344ACFA70C5EBA9D13B92AE220393D5D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (131) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1