Behavioral task
behavioral1
Sample
NEXU$.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
NEXU$.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
NEXU$.exe
Resource
win10v2004-20240226-en
General
-
Target
NEXU$.exe
-
Size
27.7MB
-
MD5
9f7d0bfe3985c340f42f039fbf9c52af
-
SHA1
8769d102239db1f9befeaa67b25a7c12ea9ccf2b
-
SHA256
bf782827fee0c2350eef32b486f7750a530d0e253187f85dd6b52af0b30c8a85
-
SHA512
988f00c929d7d01b887dc511e586cc75a14180b8b65f34cc293bb998174b667cd488d4e4fc777c183f0c29c744cf649fa520f7265e13486226f3f074cdaf3f81
-
SSDEEP
786432:TBvc42en9y+aJtShY9Q6SZKb0SReIMrRRMVb:T+cUSG8Zw09YVb
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource NEXU$.exe
Files
-
NEXU$.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 11.8MB - Virtual size: 11.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 15.5MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 304KB - Virtual size: 304KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE