Overview

overview

6

Static

static

3

Nezur.exe

windows7-x64

1

Nezur.exe

windows10-2004-x64

6

lua51.dll

windows7-x64

3

lua51.dll

windows10-2004-x64

3

start.bat

windows7-x64

6

start.bat

windows10-2004-x64

6

Resubmissions

14/02/2024, 03:14

240214-drczaafe3s6

13/02/2024, 22:25

240213-2b1bmsbg826

Sharing

Copy URL Twitter E-mail

General

  • Target
    Nezur (1).zip
  • Size 477KB
  • Sample240214-drczaafe3s
  • SHA256 b21f293030df8c3706f999d014d0e31c7673e07dd45e813e23ce80c606bd74cc
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
bootkitpersistence

Malware Config

Targets

    • Target
      Nezur.exe
    • Size 89KB
    • SHA256 1cf20b8449ea84c684822a5e8ab3672213072db8267061537d1ce4ec2c30c42a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    bootkitpersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2
    • Target
      lua51.dll
    • Size 592KB
    • SHA256 ff976f6e965e3793e278fa9bf5e80b9b226a0b3932b9da764bffc8e41e6cdb60
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3behavioral4
    • Target
      start.bat
    • Size 548B
    • SHA256 cab7b8973dd5f7252af6a1a080deec442acd1e6bdd6c7476bd73e39553751222
    • MD5 SHA1 SHA512
    Score
    6/10

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks