home

nepro0xz.exe

The executable nepro0xz.exe has been detected as malware by 46 anti-virus scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘nepro0xz’. This trojan will attemp to establish a connection to a remote server through various TCP ports and will use Winlogon to survive reboots.
MD5:
fc00df616a0937ee2201c36935b03e71

SHA-1:
97f7c2dc441c8bf2cf365fafa9b269ff32562f07

Scanner detections:
46 / 68

Status:
Malware

Analysis date:
4/25/2024 9:22:06 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.KDZ.3011
864

Agnitum Outpost
Trojan.Agent
7.1.1

Avira AntiVirus
BDS/Agent.KN.8
7.11.149.250

avast!
Win32:Malware-gen
2014.9-140923

AVG
Generic30
2015.0.3342

Baidu Antivirus
Trojan.Win32.Agent
4.0.3.14923

Bitdefender
Trojan.Generic.KDZ.3011
1.0.20.1330

Bkav FE
W32.LuckinetB.Trojan
1.3.0.4959

Comodo Security
TrojWare.Win32.Injector.ACLS
18281

Dr.Web
Win32.HLLW.Phorpiex.54
9.0.1.0266

Emsisoft Anti-Malware
Trojan.Generic.KDZ.3011
8.14.09.23.01

ESET NOD32
Win32/Lethic.AA
8.9806

Fortinet FortiGate
W32/Jorik_IRCbot.WDK!tr
9/23/2014

F-Prot
W32/Trojan3.EOQ
v6.4.7.1.166

F-Secure
Trojan.Generic.KDZ.3011
11.2014-23-09_3

G Data
Trojan.Generic.KDZ.3011
14.9.24

IKARUS anti.virus
Trojan.Win32.Lethic
t3scan.1.6.1.0

K7 AntiVirus
Trojan
13.177.12101

Kaspersky
Trojan.Win32.Jorik.IRCbot
14.0.0.3207

Malwarebytes
Trojan.Bublik
v2014.09.23.01

McAfee
PWS-Zbot.gen.are
5600.6998

Microsoft Security Essentials
Trojan:Win32/Lethic.B
1.10502

MicroWorld eScan
Trojan.Generic.KDZ.3011
15.0.0.798

NANO AntiVirus
Trojan.Win32.Jorik.bkslqb
0.28.0.59911

Norman
Troj_Generic.GIZBH
11.20140923

nProtect
Trojan/W32.Jorik.71680.M
14.05.15.01

Panda Antivirus
Trj/OCJ.B
14.09.23.01

Qihoo 360 Security
Win32/Trojan.BO.b8d
1.0.0.1015

Quick Heal
Trojan.Hoptto.A
9.14.14.00

Rising Antivirus
PE:Trojan.Win32.Generic.13F8ADAB!335064491
23.00.65.14921

Sophos
Mal/EncPk-AIC
4.98

SUPERAntiSpyware
Trojan.Agent/Gen
10342

Total Defense
Win32/IrcBot.KFE
37.0.10939

Trend Micro House Call
TROJ_JORIK.DAM
7.2.266

Trend Micro
TROJ_JORIK.DAM
10.465.23

Vba32 AntiVirus
BScope.Backdoor.IRCBot.8113
3.12.26.0

VIPRE Antivirus
Trojan.Win32.Encpk.aic
29260

ViRobot
Trojan.Win32.S.Agent.71680.P
2011.4.7.4223

File size:
70 KB (71,680 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
12/30/2012 3:19:10 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
1536:8QcVLV6VWRVKDA8acl//3sKA80frapbR0RmcPyJxH5XFCok2XL:9cWVCgDA8acl//3sKA80fruv8yDFFCrK

Entry address:
0x60F6

Entry point:
E8, D4, 13, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 45, 08, 8B, 00, 81, 38, 63, 73, 6D, E0, 75, 2A, 83, 78, 10, 03, 75, 24, 8B, 40, 14, 3D, 20, 05, 93, 19, 74, 15, 3D, 21, 05, 93, 19, 74, 0E, 3D, 22, 05, 93, 19, 74, 07, 3D, 00, 40, 99, 01, 75, 05, E8, 2E, 14, 00, 00, 33, C0, 5D, C2, 04, 00, 68, 00, 61, 40, 00, FF, 15, 20, B0, 40, 00, 33, C0, C3, 8B, FF, 55, 8B, EC, 68, 30, B1, 40, 00, FF, 15, 28, B0, 40, 00, 85, C0, 74, 15, 68, 20, B1, 40, 00, 50, FF, 15, 24, B0, 40, 00, 85, C0, 74, 05, FF, 75...
 
[+]

Code size:
37 KB (37,888 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
nepro0xz

Command:
C:\recycler\{random}\nepro0xz.exe


Remove nepro0xz.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.