Overview

overview

7

Static

static

7

Microsoft....ng.dll

windows7-x64

1

Microsoft....ng.dll

windows10-2004-x64

1

Microsoft....re.dll

windows7-x64

1

Microsoft....re.dll

windows10-2004-x64

1

Microsoft....ms.dll

windows7-x64

1

Microsoft....ms.dll

windows10-2004-x64

1

Microsoft....pf.dll

windows7-x64

1

Microsoft....pf.dll

windows10-2004-x64

1

Nezur.dll

windows7-x64

5

Nezur.dll

windows10-2004-x64

7

Nezur_Interface.exe

windows7-x64

1

Nezur_Interface.exe

windows10-2004-x64

1

Nezur_Interface.exe

windows7-x64

3

Nezur_Interface.exe

windows10-2004-x64

6

Nezur_Inte...pet.js

windows7-x64

3

Nezur_Inte...pet.js

windows10-2004-x64

3

runtimes/w...er.dll

windows7-x64

1

runtimes/w...er.dll

windows10-2004-x64

1

runtimes/w...er.dll

windows10-2004-x64

1

runtimes/w...er.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Nezur_Executor.zip

  • Size

    22.5MB

  • Sample

    241221-r421ts1qcj

  • MD5

    4d37f25041bdde67a14e56c81df22d2d

  • SHA1

    889cdd97c8e162e7b252f9a697c6458076b49483

  • SHA256

    6dba900ba4e73e88cf3d3a062f71735f30e615436d01aa96d18545e97d31a5a4

  • SHA512

    e8b8d2954158f0f263a46dfb018fd1cf13d9f6c3ef9de2add1dd2cd23be8b42dd50fff15fd89230c81df7a73ad8e16aeca8014db302f22505b3187b866d0ce05

  • SSDEEP

    393216:CUvQPnPTpXYGgYlaUucsYWCa+uiGgphlV+ybX9ltoIY1VzH7X9wmRJ4rSm9Hhy/m:HvQvdXnO1sFXPKPqja/fltD3IFj

Score
7/10
discoveryexecutionthemida

Malware Config

Targets

    • Target

      Microsoft.Extensions.FileSystemGlobbing.dll

    • Size

      44KB

    • MD5

      470ad714b6cb486c3a64a918e72497a7

    • SHA1

      13583e2627ff47fa64c192d8f91e06c4472e6cda

    • SHA256

      ed0855b522f09b5a9ddbb85de62042c25e07d10044086da8620c845de41e473c

    • SHA512

      6237af61b1f592fd10692906024fc970cd41f3db971c2a869aed392ad686a904edb19dae81cc247b691a26a7e5e554affdf0853b1e29938d6cea799e20343c77

    • SSDEEP

      768:m0PO7gRE3x5o7UP04wqgYtqPRw02KO7I9Yfwbhgv5NFcEn9zT8n3:m02GE3xOwP04wqgYtm2nQY4Ngv5NFT96

    Score
    1/10
    behavioral1behavioral2

    • Target

      Microsoft.Web.WebView2.Core.dll

    • Size

      575KB

    • MD5

      ae3a2648bf76a4dfc83d5e0dcb68f3d4

    • SHA1

      9c33e130e4f071f700321312317d0d66b2b3d8a4

    • SHA256

      8ce541fab9d6334a97b6981e2ff1a72aa7979df913e93cb5be1536de0667cc5d

    • SHA512

      8bb3dbb95386ccc5450fe0fd0853382092af8660009112646dca13f934e766b503fa7d9c1c91322326e0c9bae0df9643cbb2f101f256615a3b66e89d93e92aa5

    • SSDEEP

      12288:emV6hdWrpQ322vy+uFKcDguRFNEMFeu+imQ269pRFZNIEJdIEY0lxEIPrEIgcvLz:j/

    Score
    1/10
    behavioral3behavioral4

    • Target

      Microsoft.Web.WebView2.WinForms.dll

    • Size

      37KB

    • MD5

      0582173917034dc688d21a0307110809

    • SHA1

      ac3ffb19925eee8edc4568b1715bf873784814c4

    • SHA256

      4921c17b3cf8225a380ab1a07682fa57fcb50dc42669a010e8acb28739f418d4

    • SHA512

      3da9b59ba73a151db587e24aea79153b607984d6a48fdce769d77b47ad72eb66c412e026363abcb096ca562a1938a260c8de4a81774bef83278e117ef4b79984

    • SSDEEP

      768:fHNav/17oaKzbvttZDgcEST3p4Jjrjh2jJ+SG2au8vxJKia5/Zi/ZG4Kju6b+5ol:1avYvttZDgcEST3p4JjrjaJ+SG2au4xo

    Score
    1/10
    behavioral5behavioral6

    • Target

      Microsoft.Web.WebView2.Wpf.dll

    • Size

      81KB

    • MD5

      c7984acb66b1dd21f9f88113f7f295be

    • SHA1

      4d6cc744c3ce66a79f5fe05913909919b6042d28

    • SHA256

      d90b35a7804412550364088d8dd0402422d1ba23c8f0b2a845c043d032dc0304

    • SHA512

      364fced6b4e3abb8dd40c49380aec218da394f485a1eb5c8f82d994d1fbcd7e08616e306fb06f8d0b198ec2ff7f0f580b8fd6d4586da4414d5ba237c5595e99c

    • SSDEEP

      1536:6VzQfLOHAjUIOL3VwnhZ8fYSDHf9WyER30mpc4Jjr4YeUq9GhVU0o2zQvUuakWUp:Wcfyg4IjhZ8TDHf9c30mpc4Jjr4YeUqT

    Score
    1/10
    behavioral7behavioral8

    • Target

      Nezur.dll

    • Size

      13.5MB

    • MD5

      1b626d41591cf75d4abf0b4ab19aff5e

    • SHA1

      a31cc603496cff04b48fb20bd8b1daecf0fa2422

    • SHA256

      06086a415130d6af88acc2cae9803129257901552335adb35d7ae3c717a0bebf

    • SHA512

      55758cb2d1f9d82e78f8373cb2d2548de97a6d6999ab0f4c1e4991cb7fc4c81f3b9455b8f9200efb4af34a6c467b24926116ec5bd8d0d55c26df6a630c34b65f

    • SSDEEP

      393216:CR49RNvgubUNaugC+eJJFPU69DNBp3iU700U:CeDyUUeWJDdRNU

    Score
    7/10
    themida

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral10behavioral9

    • Target

      Nezur_Interface.dll

    • Size

      6.4MB

    • MD5

      5e975740e102716f97f71abeaf5dcf62

    • SHA1

      d57a5e40cb351eb739cffd24a6855ab21654063f

    • SHA256

      f07c2a215d43e783f096810a3a89cdd8c3cd99b56c774e7cdb5ab399cc73bd36

    • SHA512

      dd1ed65c09c6ae815b174b1eea0817f155bbf7541fc48aa0e63c51358a8b3948474e956adf1c6ec3713c49b524402603193a7bd8cb03710175e65b0b3b226d6e

    • SSDEEP

      98304:AQuiXvqdeO4pbZVj9JPgBzjYz067yqu/mnFQOi33nFbO4KSgPTPgS8NAvKBUuYJg:ARiSZO9S2fasv+Bpt

    Score
    1/10
    behavioral11behavioral12

    • Target

      Nezur_Interface.exe

    • Size

      154KB

    • MD5

      7e7adfc3bdd9b766fb15521dc6b00f25

    • SHA1

      ad6abf2d4dc87ae133be0aa8f2e77dc098ae8f8a

    • SHA256

      3e08f027849d86c17909b507b25df78521afe175bcf30424f70ccabbfdf7665f

    • SHA512

      29b33965f5a0b095b3fe8c16c88015584c62067fe3d78da4e4ec131d42918450dbec71e63bf7ba8917c531a4adccf8c0badf8c043523d959d964186789c01fab

    • SSDEEP

      3072:WAi4pxpEHmAdx4/kyHRZa0YiRAl278IVn2JbS1cJa8lWjfl:WAi4pxpRkyHRZa0Gl278IVNc0cWD

    Score
    6/10
    discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral13behavioral14

    • Target

      Nezur_Interface.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.57/adblock_snippet.js

    • Size

      2KB

    • MD5

      f5c93c471485f4b9ab45260518c30267

    • SHA1

      ee6e09fb23b6f3f402e409a2272521fdd7ad89ed

    • SHA256

      9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690

    • SHA512

      e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda

    Score
    3/10
    execution
    behavioral15behavioral16

    • Target

      runtimes/win-arm64/native/WebView2Loader.dll

    • Size

      136KB

    • MD5

      232e9d314b9bb9e677b1d79c7dc54e44

    • SHA1

      5ad36b7a527acd76e7f5414459ba61ea319bd120

    • SHA256

      dbd30934e8fb2706722a2b874719d62cbed47b1e473e3f684a66648e91f93def

    • SHA512

      504230199dea2c72c47374240a6ef66fc648208bb5f01520d057dbdf13fb04f3508e1edfc2f2db3d6b8f7321d0d150d9192b7a20a4465b702b10126e1a2861be

    • SSDEEP

      3072:rwe4zkOpEbtYRLMPM6OSRTA0gWEtJW9VDX4B2TX:UeEkOebMqgWEtJiVDX5b

    Score
    1/10
    behavioral17behavioral18

    • Target

      runtimes/win-x64/native/WebView2Loader.dll

    • Size

      161KB

    • MD5

      3fac859547077abafe806ff1e4709f47

    • SHA1

      0366df220c5d224ee64a42c929574407d2e6d2c9

    • SHA256

      f4d811cda483adb33220c5a856c5ec8dca3a095fde54b44f08e1279a6a5efd33

    • SHA512

      9b7b7aabf6bdc11dfd74430336e02d7d2b96b6bbf352f1e2d158a4900bead364900820af56cf9af25366ff5704e2ffcc2458d45dc3efe00ebd0843d127ab7435

    • SSDEEP

      3072:JX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipT3YEtJ5+PON2Yo:JDTlTRTFOYfThTNTvDhvZkPEKdI7pxEG

    Score
    1/10
    behavioral19

    • Target

      runtimes/win-x86/native/WebView2Loader.dll

    • Size

      113KB

    • MD5

      999f67ef1a2d06beeaf85ec9b5d5d73d

    • SHA1

      644b1768f8675b29fb53a51edb5d344fdf55946c

    • SHA256

      4c24ade2c2a4cf652529fdf4259743fec824c628bdc056fc5c76c29e30e7c06c

    • SHA512

      6399fda1c54bd26ce82b7d48ac1b7c9741d5abf68a67bd62ec53ea2a1f82caac2e9bfdb1cb22f5af3c8ca6f4789a888f6519e02941f6c33f6f9d3b0e58eb56f4

    • SSDEEP

      3072:OnbFYqJx7sXRq2KVs9iiamgqeNZPTj7EtJlAlHJcgf4fm9pS:OZYqJx4gkYiavEtJe9f2mbS

    Score
    3/10
    discovery
    behavioral20

MITRE ATT&CK Enterprise v15

Tasks