In this article, I am going to describe how the NabucurObfs trojan infused into your system, and the best way to remove NabucurObfs trojan virus.
What is NabucurObfs trojan?
Name | NabucurObfs |
Infection Type | Trojan |
Symptoms |
|
Similar behavior | SpyStealer, Porlist, PSWStealer, Sidewinder, FakeAud, SuperThreat |
Fix Tool | See If Your System Has Been Affected by NabucurObfs trojan |
Trojan viruses are among the leading malware types by its injection frequency for quite a very long time. And now, during the pandemic, when malware became extremely active, trojan viruses increased their activity, too. You can see lots of messages on various websites, where people are grumbling about the NabucurObfs trojan virus in their computers, as well as asking for help with NabucurObfs trojan virus clearing.
Trojan NabucurObfs is a sort of virus that injects right into your system, and then performs a wide range of destructive features. These functions depend upon a sort of NabucurObfs trojan: it may act as a downloader for many other malware or as a launcher for an additional destructive program which is downloaded in addition to the NabucurObfs trojan. Over the last 2 years, trojans are also spread via e-mail attachments, and most of situations utilized for phishing or ransomware injection.
NabucurObfs2 also known as
Bkav | W32.AIDetect.malware1 |
Lionic | Virus.Win32.PolyRansom.n!c |
Elastic | malicious (high confidence) |
MicroWorld-eScan | Win32.Virlock.Gen.5 |
FireEye | Generic.mg.dac3585910ac4609 |
CAT-QuickHeal | Ransom.PolyRansom.B2 |
ALYac | Win32.Virlock.Gen.5 |
Cylance | Unsafe |
Sangfor | Suspicious.Win32.Save.a |
K7AntiVirus | Virus ( 0040f99f1 ) |
K7GW | Virus ( 0040f99f1 ) |
Cybereason | malicious.910ac4 |
Arcabit | Win32.Virlock.Gen.5 |
Baidu | Win32.Virus.Virlock.a |
VirIT | Win32.CryptorGen.A |
Cyren | W32/A-eb557c81!Eldorado |
tehtris | Generic.Malware |
ESET-NOD32 | a variant of Win32/Virlock.C |
APEX | Malicious |
Paloalto | generic.ml |
ClamAV | BC.Win.Virus.Ransom-9157.B |
Kaspersky | Virus.Win32.PolyRansom.a |
BitDefender | Win32.Virlock.Gen.5 |
NANO-Antivirus | Trojan.Win32.PolyRansom.exypia |
SUPERAntiSpyware | Trojan.Agent/Gen-Crypt |
Avast | Win32:VirLock [Inf] |
Rising | Virus.VirLock!1.A08A (CLASSIC) |
Ad-Aware | Win32.Virlock.Gen.5 |
TACHYON | Virus/W32.VirRansom.C |
Emsisoft | Win32.Virlock.Gen.5 (B) |
Comodo | Packed.Win32.Graybird.B@5hgpd5 |
DrWeb | Win32.VirLock.4 |
Zillya | Virus.PolyRansom.Win32.2 |
TrendMicro | PE_VIRLOCK.E |
McAfee-GW-Edition | BehavesLike.Win32.VirRansom.tc |
Sophos | ML/PE-A + W32/VirRnsm-A |
SentinelOne | Static AI – Malicious PE |
Jiangmin | Win32/Polyransom.a |
Avira | TR/Crypt.XPACK.Gen7 |
Microsoft | Trojan:Win32/NabucurObfs |
GData | Win32.Virlock.Gen.5 |
Cynet | Malicious (score: 100) |
AhnLab-V3 | Win32/Nabucur.B |
McAfee | W32/VirRansom |
MAX | malware (ai score=83) |
VBA32 | Virus.VirLock |
Malwarebytes | Bladabindi.Backdoor.Njrat.DDS |
TrendMicro-HouseCall | PE_VIRLOCK.E |
Tencent | Virus.Win32.Polyransom.a |
Ikarus | Virus.Win32.Nabucur |
MaxSecure | Virus.PolyRansom.a |
Fortinet | W32/Virlock.K |
BitDefenderTheta | AI:FileInfector.47FA551513 |
AVG | Win32:VirLock [Inf] |
Panda | Generic Suspicious |
CrowdStrike | win/malicious_confidence_100% (W) |
What are the symptoms of NabucurObfs trojan?
- Behavioural detection: Executable code extraction – unpacking;
- SetUnhandledExceptionFilter detected (possible anti-debug);
- Attempts to connect to a dead IP:Port (3 unique times);
- Creates RWX memory;
- Dynamic (imported) function loading detected;
- Enumerates running processes;
- Expresses interest in specific running processes;
- Repeatedly searches for a not-found process, may want to run with startbrowser=1 option;
- Reads data out of its own binary image;
- Manipulates data from or to the Recycle Bin;
- A process created a hidden window;
- Executed a command line with /V argument which modifies variable behaviour and whitespace allowing for increased obfuscation options;
- Drops a binary and executes it;
- The binary likely contains encrypted or compressed data.;
- Authenticode signature is invalid;
- A scripting utility was executed;
- Uses Windows utilities for basic functionality;
- Uses Windows utilities for basic functionality;
- A process attempted to delay the analysis task by a long amount of time.;
- Created a process from a suspicious location;
- Installs itself for autorun at Windows startup;
- Installs itself for autorun at Windows startup;
- Attempts to disable UAC;
- Anomalous binary characteristics;
- Attempts to modify Explorer settings to prevent file extensions from being displayed;
- Attempts to modify Explorer settings to prevent hidden files from being displayed;
- Uses suspicious command line tools or Windows utilities;
The usual symptom of the NabucurObfs trojan virus is a steady entrance of different malware – adware, browser hijackers, and so on. Due to the activity of these malicious programs, your system comes to be very lagging: malware absorbs big amounts of RAM and CPU capabilities.
Another noticeable effect of the NabucurObfs trojan virus presence is unknown operations showed off in task manager. Often, these processes may try to simulate system processes, but you can recognize that they are not legit by taking a look at the genesis of these processes. Pseudo system applications and NabucurObfs trojan’s processes are always specified as a user’s tasks, not as a system’s.
How to remove NabucurObfs trojan virus?
- Download and install Loaris Trojan Remover.
- Open Loaris and perform a “Standard scan“.
- “Move to quarantine” all items.
- Open “Tools” tab – Press “Reset Browser Settings“.
- Approve the reset pressing “Yes” button in the appeared window.
- Restart your computer.
To erase NabucurObfs trojan and also be sure that all extra malware, downloaded with the help of this trojan, will certainly be removed, as well, I’d suggest you to use Loaris Trojan Remover.
NabucurObfs removal guide
To detect and remove all viruses on your personal computer using Loaris, it’s better to use Standard or Full scan. Removable scan, as well as Custom, will check only specified directories, so these checks are not able to provide the full information.
You can observe the detects till the scan process goes. Nonetheless, to perform any actions against detected malicious items, you need to wait until the process is over, or to interrupt the scanning process.
To designate the appropriate action for each detected viruses, click the button in front of the name of detected malware. By default, all viruses will be moved to quarantine.
How to remove NabucurObfs Trojan?
Name: NabucurObfs
Description: Trojan NabucurObfs is a kind of virus that infiltrates into your computer, and after that performs different destructive functions. These features depend upon a type of NabucurObfs trojan: it can act as a downloader for many other malware or as a launcher for another destructive program which is downloaded in addition to the NabucurObfs trojan. During the last two years, trojans are also dispersed via e-mail attachments, and most of situations utilized for phishing or ransomware infiltration.
Operating System: Windows
Application Category: Trojan
User Review
( votes)- What is Trojan Horse: https://en.wikipedia.org/wiki/Trojan_horse_(computing)
- NabucurObfs VirusTotal Report: https://www.virustotal.com/api/v3/files/ce7111dc3ffc16502cb7b78b727ab56fd1747a77ab2c04c16c4cf1122d481cf1