1. Home
  2. Software
  3. Nerex

Nerex

Nerex is a Trojan used by Elderwood to open a backdoor on compromised hosts. [1] [2]

ID: S0210
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 18 April 2018
Last Modified: 06 January 2021
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1112 修改注册表

Nerex creates a Registry subkey that registers a new service.[2]
Enterprise T1543 .003 创建或修改系统进程: Windows Service

Nerex creates a Registry subkey that registers a new service.[2]
Enterprise T1105 输入工具传输

Nerex creates a backdoor through which remote attackers can download files onto a compromised host.[3]
Enterprise T1553 .002 颠覆信任控制: Code Signing

Nerex drops a signed Microsoft DLL to disk.[2]

Groups That Use This Software

ID Name References
G0066 Elderwood

[1]

References

  1. O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved February 15, 2018.
  2. Ladley, F. (2012, May 15). Backdoor.Nerex. Retrieved February 23, 2018.
  1. Ladley, F. (2012, May 15). Backdoor.Ritsol. Retrieved February 23, 2018.