Nezur (1)[.]zip | Triage™

Resubmissions

14/02/2024, 03:14

240214-drczaafe3s6

13/02/2024, 22:25

240213-2b1bmsbg826

Sharing

Copy URL Twitter E-mail

General

Target
Nezur (1).zip
Size 477KB
Sample240213-2b1bmsbg82
SHA256 b21f293030df8c3706f999d014d0e31c7673e07dd45e813e23ce80c606bd74cc
MD5 299ae221cfd986385576228b45c3e076
SHA1 6b533e1fe33d7e67bbe58c64997a81c49308e9a4
SHA512 36732d46253feba81fed54fd7d0317ea2c8cb76306ba03f5d8c452d262d07c850c3c5d38e53c3ef01010e83918ea987258e4b15674f84cfba39db80105206efe
SSDEEP 12288:eiN+cU0Yz3jBL75xwc4XscIFl4zA6fzvBLLkwRy:RKjRdxwr81FlQxfDxLkd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Nezur.exe
unpack001/lua51.dll

File Explorer

Nezur (1).zip

.zip 477KB
Nezur.exe

.exe 89KB
README.txt

928B
auto_load.txt

187KB
configs/autosave.cfg

916B
lua51.dll

.dll 592KB
start.bat

.bat .vbs 548B

Nezur (1).zip

SHA256 b21f293030df8c3706f999d014d0e31c7673e07dd45e813e23ce80c606bd74cc
MD5 299ae221cfd986385576228b45c3e076
SHA1 6b533e1fe33d7e67bbe58c64997a81c49308e9a4
SHA512 36732d46253feba81fed54fd7d0317ea2c8cb76306ba03f5d8c452d262d07c850c3c5d38e53c3ef01010e83918ea987258e4b15674f84cfba39db80105206efe
SSDEEP 12288:eiN+cU0Yz3jBL75xwc4XscIFl4zA6fzvBLLkwRy:RKjRdxwr81FlQxfDxLkd
MD5 SHA1 SHA512 SSDEEP

Nezur.exe

IMPHASH d0264e200554ef617c521261fe8fe2a4
SHA256 1cf20b8449ea84c684822a5e8ab3672213072db8267061537d1ce4ec2c30c42a
MD5 dd98a43cb27efd5bcc29efb23fdd6ca5
SHA1 38f621f3f0df5764938015b56ecfa54948dde8f5
SHA512 871a2079892b1eb54cb761aebd500ac8da96489c3071c32a3dab00200f74f4e12b9ab6c62623c53aea5b8be3fc031fb1b3e628ffe15d73323d917083240742b0
SSDEEP 1536:Ee7h7q/J6K3nHC+AGUob2f0DBFPbPWNPWp350NHcHkDsWqxcd2ZPSAv:Ee7oU8HC+AGUu2abPbPWQpO8E0A2tSAv
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10187

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

lua51

lua_gettop luaJIT_version_2_1_0_beta3 luaL_openlibs luaL_traceback luaL_newstate luaL_loadbuffer luaL_loadfile luaL_where luaL_callmeta lua_sethook lua_concat lua_error lua_gc lua_cpcall lua_pcall lua_call lua_rawseti lua_setfield lua_createtable lua_rawgeti lua_getfield lua_gettable lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushstring lua_pushlstring lua_pushnil lua_objlen lua_tolstring lua_toboolean lua_type lua_isstring lua_insert lua_remove lua_pushvalue lua_settop lua_close

kernel32

TlsAlloc DecodePointer ReadConsoleW ReadFile WriteConsoleW CreateFileW CloseHandle HeapReAlloc HeapSize SetFilePointerEx GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType LCMapStringW CompareStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW SetConsoleCtrlHandler GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc

lua51.dll

IMPHASH 9466a71df1d3a59794f8605626534abe
SHA256 ff976f6e965e3793e278fa9bf5e80b9b226a0b3932b9da764bffc8e41e6cdb60
MD5 3dff7448b43fcfb4dc65e0040b0ffb88
SHA1 583cdab08519d99f49234965ffd07688ccf52c56
SHA512 cdcbe0ec9ddd6b605161e3c30ce3de721f1333fce85985e88928086b1578435dc67373c3dc3492ed8eae0d63987cac633aa4099b205989dcbb91cbbfc8f6a394
SSDEEP 12288:rs7/mj/73RaLHIW5BmUeUhoE4RgiF1q1bPIBKsg4Db0S:rc/u/7IoRnUKfq1Dl4DY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

343186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError SetLastError VirtualAlloc VirtualFree VirtualQuery VirtualProtect FreeLibrary GetModuleHandleExA GetProcAddress LoadLibraryExA FormatMessageA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep CreateThread RtlUnwind GetModuleFileNameA GetModuleHandleA IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetEndOfFile InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW ReadFile CloseHandle DuplicateHandle CreateProcessA GetTempPathW QueryPerformanceFrequency MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode GetStdHandle GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW DecodePointer GetACP SetFilePointerEx GetExitCodeProcess GetFileAttributesExW CreatePipe CreateFileW GetTimeZoneInformation DeleteFileW MoveFileExW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap SetStdHandle GetStringTypeW HeapSize HeapReAlloc WriteConsoleW

luaJIT_profile_dumpstack luaJIT_profile_start luaJIT_profile_stop luaJIT_setmode luaJIT_version_2_1_0_beta3 luaL_addlstring luaL_addstring luaL_addvalue luaL_argerror luaL_buffinit luaL_callmeta luaL_checkany luaL_checkinteger luaL_checklstring luaL_checknumber luaL_checkoption luaL_checkstack luaL_checktype luaL_checkudata luaL_error luaL_execresult luaL_fileresult luaL_findtable luaL_getmetafield luaL_gsub luaL_loadbuffer luaL_loadbufferx luaL_loadfile luaL_loadfilex luaL_loadstring luaL_newmetatable luaL_newstate luaL_openlib luaL_openlibs luaL_optinteger luaL_optlstring luaL_optnumber luaL_prepbuffer luaL_pushmodule luaL_pushresult luaL_ref luaL_register luaL_setfuncs luaL_setmetatable luaL_testudata luaL_traceback luaL_typerror luaL_unref luaL_where lua_atpanic lua_call lua_checkstack lua_close lua_concat lua_copy lua_cpcall lua_createtable lua_dump lua_equal lua_error lua_gc lua_getallocf lua_getfenv lua_getfield lua_gethook lua_gethookcount lua_gethookmask lua_getinfo lua_getlocal lua_getmetatable lua_getstack lua_gettable lua_gettop lua_getupvalue lua_insert lua_iscfunction lua_isnumber lua_isstring lua_isuserdata lua_isyieldable lua_lessthan lua_load lua_loadx lua_newstate lua_newthread lua_newuserdata lua_next lua_objlen lua_pcall lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushinteger lua_pushlightuserdata lua_pushlstring lua_pushnil lua_pushnumber lua_pushstring lua_pushthread lua_pushvalue lua_pushvfstring lua_rawequal lua_rawget lua_rawgeti lua_rawset lua_rawseti lua_remove lua_replace lua_resume lua_setallocf lua_setfenv lua_setfield lua_sethook lua_setlocal lua_setmetatable lua_settable lua_settop lua_setupvalue lua_status lua_toboolean lua_tocfunction lua_tointeger lua_tointegerx lua_tolstring lua_tonumber lua_tonumberx lua_topointer lua_tothread lua_touserdata lua_type lua_typename lua_upvalueid lua_upvaluejoin lua_version lua_xmove lua_yield luaopen_base luaopen_bit luaopen_debug luaopen_ffi luaopen_io luaopen_jit luaopen_math luaopen_os luaopen_package luaopen_string luaopen_table

Nezur (1).zip

Nezur.exe

lua51

kernel32

generic

README.txt

auto_load.txt

configs/autosave.cfg

lua51.dll

kernel32

generic

start.bat