nabucur | aa7d145d484fa892d093a57572d71ab2db9d6685287693669adba5d445a92545

General

Target
aa7d145d484fa892d093a57572d71ab2db9d6685287693669adba5d445a92545
Size 1.8MB
Sample260912-1t7yrsyset
SHA256 aa7d145d484fa892d093a57572d71ab2db9d6685287693669adba5d445a92545
MD5 6ccb1ac52640f8f93159c7496e5778f8
SHA1 ddcb67facbc7b5aabeb7b48ae9a10ec662003af8
SHA512 1f743784b74803b4ee3519395c7dd51211020e48c9148dcdbcf122857cc26fc617ff7a0737bddaacdb2eed8e755726838847d007c41a5c374b1914cd28a414e6
SSDEEP 12288:7gsyBo+rnwrtFsg+T0oRQDYc0rR5SKlasHNEMUGYZKbEM4kIO11j9wuK6Jmi67i:E9rnwrtNC0oqDxkFHu4yKbEMxjjAXb7i
TLSH
T16F85950792F0281D991D4BE744F58683D958E4A0E7D979FE53EC079CD1B24EE3328A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  aa7d145d484fa892d093a57572d71ab2db9d6685287693669adba5d445a92545
- Size 1.8MB
- SHA256 aa7d145d484fa892d093a57572d71ab2db9d6685287693669adba5d445a92545
- MD5 6ccb1ac52640f8f93159c7496e5778f8
- SHA1 ddcb67facbc7b5aabeb7b48ae9a10ec662003af8
- SHA512 1f743784b74803b4ee3519395c7dd51211020e48c9148dcdbcf122857cc26fc617ff7a0737bddaacdb2eed8e755726838847d007c41a5c374b1914cd28a414e6
- SSDEEP 12288:7gsyBo+rnwrtFsg+T0oRQDYc0rR5SKlasHNEMUGYZKbEM4kIO11j9wuK6Jmi67i:E9rnwrtNC0oqDxkFHu4yKbEMxjjAXb7i
- TLSH
  T16F85950792F0281D991D4BE744F58683D958E4A0E7D979FE53EC079CD1B24EE3328A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (158) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1