nabucur | 2d6a9b643a25cd588673712ef3a223feb45939197fb1bc2ee4d83b5382a8d02f

General

Target
2026-11-13_60c581957e166dce26f200ac8fdc4996_elex_virlock
Size 4.0MB
Sample261114-pt342agz2s
SHA256 2d6a9b643a25cd588673712ef3a223feb45939197fb1bc2ee4d83b5382a8d02f
MD5 60c581957e166dce26f200ac8fdc4996
SHA1 317096863740bf4c5fa7d1aa433a44a19f3f21c6
SHA512 b9293241366ea1cf93ce26de91e0f83429b409a431fa7c1c3a3213eac247c562bab0915b6afc128c7ead20b7616a6aa662c8d8db74ca0266c21b20382256199d
SSDEEP 98304:7/aCjUeyWA63NmN+64s6ggEim6IBR1rwP:tyA9mN+ds6ggEim6q/r2
TLSH
T18616E4BD9A90FE02BF32F5717A34C5B7AAD895E1D282C6C5D43F43B3A49C8563C49860
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-13_60c581957e166dce26f200ac8fdc4996_elex_virlock
- Size 4.0MB
- SHA256 2d6a9b643a25cd588673712ef3a223feb45939197fb1bc2ee4d83b5382a8d02f
- MD5 60c581957e166dce26f200ac8fdc4996
- SHA1 317096863740bf4c5fa7d1aa433a44a19f3f21c6
- SHA512 b9293241366ea1cf93ce26de91e0f83429b409a431fa7c1c3a3213eac247c562bab0915b6afc128c7ead20b7616a6aa662c8d8db74ca0266c21b20382256199d
- SSDEEP 98304:7/aCjUeyWA63NmN+64s6ggEim6IBR1rwP:tyA9mN+ds6ggEim6q/r2
- TLSH
  T18616E4BD9A90FE02BF32F5717A34C5B7AAD895E1D282C6C5D43F43B3A49C8563C49860
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution nabucur persistence ransomware spyware stealer trojan
- Family: Nabucur
  Nabucur is a ransomware first seen in 2015.
  ransomware nabucur
- Modifies visibility of file extensions in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Renames multiple (166) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral1 behavioral2