Extracted

• • Target

    Nexus.exe

  • Size

    952KB

  • MD5

    7810f2e2c8cad759720e963897a280d8

  • SHA1

    9d427df697eb19c8a011b852c04a1c351d111312

  • SHA256

    ff1b8f8a4d7fcd8081bf395561e9147ca934b74d6b9e04b5a31294c3545bb2d3

  • SHA512

    ccc23c8e26f1dd85dbee275b907bc35d7ea6532ea2e28e4067cac59cf3f6554b46a9141c6047f40e7a6a8ef4470ee39c997d2f5d7bc8573fcd5f6b262a9e8787

  • SSDEEP

    12288:9OxPkPjQeqQ1Y53KR8PKpL7R50aRweHvZIp7rt9CRMmmXeu/IsbPR2CfNS+jWC71:rEeqQq3KDPRcePCp7rGRMLXeAVRHS+35

  Score

  10^/10

  umbralxwormcredential_accessdiscoveryevasionexecutionpersistenceratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Umbral payload

  • Detect Xworm Payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    evasiontrojan

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1