Overview

overview

10

Static

static

10

Nexus/Boot...er.exe

windows7-x64

7

Nexus/Boot...er.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Nexus.zip

  • Size

    8.2MB

  • Sample

    241121-k6mwcszgkb

  • MD5

    35b3becadd9be82143576cb79f58d3e0

  • SHA1

    3d2f7074399b42acd183400d3f9732b777f1e4f9

  • SHA256

    b78d33ff1d9181a618e3403beda0aec5dbdd1fd3a430216e75912c317a84ce03

  • SHA512

    03db3fbd8ec22f3782a2d4620b59506f4d977b4c3eb0161d2ec4c3776b8d89a6ecd8969faac9a99d5a7180826bae6fe73d8070faeeaf3c499d585649dd7285b3

  • SSDEEP

    196608:8kN7/DyjClL8MEMPSRWhycWpQGkwip8DPcWPJgtiG00BB4JSyyPkY:8E/oClxEi5cpQGfJTcQwPBjqY

Score
10/10
blankgrabbercollectiondefense_evasiondiscoveryexecutionupx

Malware Config

Targets

    • Target

      Nexus/Bootstrapper.exe

    • Size

      8.3MB

    • MD5

      4c0a2aaf52a61c79953070adf85c810d

    • SHA1

      e30c5f2398b3129789feee60134d79994a77fa75

    • SHA256

      304ed8a95905a18665c4017e1216cc4bafeae5461a998c23b8301e6c2c410d8f

    • SHA512

      3d078a456f697430e8226cbcc5dd9741b1275e86c978fa8e21e1e070aaddda0865e2e4170e2e13f0d3bad9b9e30ad91ebb8690ee568c3e3a20c3eefb76e97525

    • SSDEEP

      196608:cVuYLwfI9jUCzi4H1qSiXLGVi7DMgpZASEyQ0VMwICEc/je:LIHziK1piXLGVE4UrS0VJC

    Score
    8/10
    upxcollectiondefense_evasiondiscoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

      collection

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks