Neuron, Neuron 2 and Nautilus
Indicator Release

The below indicators have been provided by the UK National Cyber Security Centre (NCSC) to enable the detection of Neuron and Nautilus malware and associated artefacts. Please use these indicators to check for the presence of these indicators on your platforms and networks.
Contents
1. Neuron
1.1 Neuron Client Files
1.2 Neuron Service Files
1.3 Neuron Yara
1.4 Neuron 2 Files
1.5 Neuron 2 Yara
2. Nautilus
2.1 Nautilus Files
2.2 Nautilus Yara

1. Neuron
1.1 Neuron Client Files
File Name	neuron-client.exe	
Description	Neuron Client	
File Size (bytes)	55808	
MD5	4ed42233962a89deaa89fd7b989db081	
SHA1	cf731ee0af5c19231ff51af589f7434c0367d508	
SHA256	a96c57c35df18ac20d83b08a88e502071bd0033add0914b951adbd1639b0b873	

File Name	Sign.exe	
Description	Dropper for the Neuron Client	
File Size (bytes)	115712	
MD5	3cd5fa46507657f723719b7809d2d1f9	
SHA1	34ddc14b9a04eba98c3aa1cb27033e12ec847e03	
SHA256	a6dbc36c472b3ba70a98efd0db35e75c340086be15d3c3ab4e39033604d0bcf9	

File Name	mydoc.doc	
Description	Macro document that drops and runs Sign.exe (client dropper)	
File Size (bytes)	591360	
MD5	66f4f1384105ce7ee1636d34f2afb1c9	
SHA1	3f23d152cc7badf728dfd60f6baa5c861a500630	
SHA256	42fbb2437faf68bae5c5877bed4d257e14788ff81f670926e1d4bbe731e7981b	

File Name	N/A	
Description	Macro document that drops and runs Sign.exe (client dropper)	
File Size (bytes)	590336	
MD5	0e430b6b203099f9c305681e1dcff375	
SHA1	845f3048fb0cfbdfb35bf6ced47da1d91ff2e2b1	
SHA256	bbe3700b5066d524dd961bd47e193ab2c34565577ce91e6d28bdaf609d2d97a8	

1.2 Neuron Service Files
File Name	Microsoft.Exchange.Service.exe	
Description	Neuron Service	
File Size (bytes)	43008	
MD5	0f12268221e27406351a6313f902b498	
SHA1	b0dbdc81a0e367330007b7e593d8dabf92ca7afd	
SHA256	d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29	

File Name	w3wpdiag.exe	
Description	Neuron Service	
File Size (bytes)	59392	
MD5	371b4380080e3d94ffcae1a7e9a0d5e2	
SHA1	f7088075d1c798f27b0d269c97dc877ff16f1401	
SHA256	2986bae15cfa78b919d21dc070be944e949a027e8047a812026e35c66ab17353	

File Name	Updater.exe	
Description	Neuron Service	
File Size (bytes)	44544	
MD5	8229622a9790d75e09a099e8758d5703	
SHA1	10586913ceeecd408da4e656c29ed4e91c6b758e	
SHA256	2f4d6a3c87770c7d42d1a1b71ed021a083b08f69ccaf63c15428c7bc6f69cb10	

File Name	w3wpdiag.exe	
Description	Neuron Service	
File Size (bytes)	58880	
MD5	a3bdc385cf68019449027bd6d8cecb4d	
SHA1	fe8da5a1e62a8d4f627834b0f26c802a330d8d45	
SHA256	0f4e9e391696ed8b9172985bb43cca7d7f2c8a4ae0493e4bf1f15b90f7138259	

File Name	dropper-svc.exe	
Description	Dropper for the Neuron service	
File Size (bytes)	85008	
MD5	d6ef3c8f2c3f3ddffbb70f5dadfa982c	
SHA1	934b288075c122165897276b360c61e77cb7bde0	
SHA256	fa543de359d498150cbcb67c1631e726a4b14b0a859573185cede5b12ad2abfb	

1.3 Neuron Yara
rule neuron_common_strings {
  meta:
    description = "Rule for detection of Neuron based on commonly used strings"
    author = "NCSC UK"
    hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
  strings:
    $strServiceName = "MSExchangeService" ascii
    $strReqParameter_1 = "cadataKey" wide
    $strReqParameter_2 = "cid" wide
    $strReqParameter_3 = "cadata" wide
    $strReqParameter_4 = "cadataSig" wide
    $strEmbeddedKey = "PFJTQUtleVZhbHVlPjxNb2R1bHVzPnZ3WXRKcnNRZjVTcCtWVG9Rb2xuaEVkMHVwWDFrVElFTUNTNEFnRkRCclNmclpKS0owN3BYYjh2b2FxdUtseXF2RzBJcHV0YXhDMVRYazRoeFNrdEpzbHljU3RFaHBUc1l4OVBEcURabVVZVklVbHlwSFN1K3ljWUJWVFdubTZmN0JTNW1pYnM0UWhMZElRbnl1ajFMQyt6TUhwZ0xmdEc2b1d5b0hyd1ZNaz08L01vZHVsdXM+PEV4cG9uZW50PkFRQUI8L0V4cG9uZW50PjwvUlNBS2V5VmFsdWU+" wide
    $strDefaultKey = "8d963325-01b8-4671-8e82-d0904275ab06" wide
    $strIdentifier = "MSXEWS" wide
    $strListenEndpoint = "443/ews/exchange/" wide
    $strB64RegKeySubstring = "U09GVFdBUkVcTWljcm9zb2Z0XENyeXB0b2dyYXBo" wide
    $strName = "neuron_service" ascii
    $dotnetMagic = "BSJB" ascii

  condition:
    (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and 6 of ($str*)
}

rule neuron_standalone_signature {
  meta:
    description = "Rule for detection of Neuron based on a standalone signature from .NET metadata"
    author = "NCSC UK"
    hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
  strings:
    $a = {eb073d151231011234080e12818d1d051281311d1281211d1281211d128121081d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281}
    $dotnetMagic = "BSJB" ascii
  condition:
    (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
}

rule neuron_functions_classes_and_vars {
  meta:
    description = "Rule for detection of Neuron based on .NET function, variable and class names"
    author = "NCSC UK"
    hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
  strings:
    $class1 = "StorageUtils" ascii
    $class2 = "WebServer" ascii
    $class3 = "StorageFile" ascii
    $class4 = "StorageScript" ascii
    $class5 = "ServerConfig" ascii
    $class6 = "CommandScript" ascii
    $class7 = "MSExchangeService" ascii
    $class8 = "W3WPDIAG" ascii
    $func1 = "AddConfigAsString" ascii
    $func2 = "DelConfigAsString" ascii
    $func3 = "GetConfigAsString" ascii
    $func4 = "EncryptScript" ascii
    $func5 = "ExecCMD" ascii
    $func6 = "KillOldThread" ascii
    $func7 = "FindSPath" ascii
    $var1 = "CommandTimeWait" ascii
    $dotnetMagic = "BSJB" ascii
  condition:
    (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and 6 of them
}

1.4 Neuron 2 Files
Name	dcomnet.dll	
Description	Neuron2 Loader (x64)	
MD5	60bcc6bc746078d81a9cd15cd4f199bb	
SHA1	c9fc7ce10aba20894ef914d2073021a48995db17	
SHA256	51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927	
Size	170496	
Compile Time	28 Nov 2017 06:25:24	

Name	neuron2.exe	
Description	Neuron2 Payload	
MD5	d891c9374ccb2a4cae2274170e8644d8	
SHA1	2fb145c64263006a95a0771b57e967977f63954d	
SHA256	83d8922e7a8212f1a2a9015973e668d7999b90e7000c31f57be83803747df015	
Size	59392	
Compile Time	28 Nov 2017 04:44:26	

1.5 Neuron 2 Yara
rule Neuron2_Loader_strings {
	strings:
		$ = "dcom_api"
		$ = "http://*:80/OWA/OAB/"
		$ = "https://*:443/OWA/OAB/"
		$ = "dcomnetsrv.cpp"
		$ = "dcomnet.dll"
		$ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb"
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 2 of them
}

rule Neuron2_Decryption_Routine {
	strings:
		$ = {81 FA FF 00 00 00 0F B6 C2 0F 46 C2 0F B6 0C 04 48 03 CF 0F B6 D1 8A 0C 14 8D 50 01 43 32 0C 13 41 88 0A 49 FF C2 49 83 E9 01}
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
}

rule Neuron2_DotNet_Strings {
	strings:
		$dotnetMagic = "BSJB"
		$s1 = "http://*:80/W3SVC/"
		$s2 = "https://*:443/W3SVC/"
		$s3 = "neuron2.exe"
		$s4 = "D:\\Develop\\sps\\neuron2\\neuron2\\obj\\Release\\neuron2.pdb"
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $dotnetMagic and any of ($s*)
}

2. Nautilus
2.1 Nautilus Files
File Name	dcomnetsrv.dll	
Description	Nautilus Loader DLL	
File Size (bytes)	121344	
MD5	2f742ec3bb7590602bc3e97326f2476a	
SHA1	9d280e3ef1b180449086dda5b92a7b9bbe63dee4	
SHA256	a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3	

File Name	oxygen.dll	
Description	Nautilus Injected payload	
File Size (bytes)	620568	
MD5	ea874ac436223b30743fc9979eed5f2f	
SHA1	5ed61ec7de11922582f07c3488ef943b439ee226	
SHA256	cefc5cf4d46abb86fb0f7c81549777cf1a2a5bfbe1ce9e7d08128ab8bfc978f8	

2.2 Nautilus Yara
rule nautilus_modified_rc4_loop {
  meta:
    description = "Rule for detection of Nautilus based on assembly code for a modified RC4 loop"
    author = "NCSC UK"
    hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
  strings:
    $a = {42 0F B6 14 04 41 FF C0 03 D7 0F B6 CA 8A 14 0C 43 32 14 13 41 88 12 49 FF C2 49 FF C9}
  condition:
    (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $a
}

rule nautilus_rc4_key {
  meta:
    description = "Rule for detection of Nautilus based on a hardcoded RC4 key"
    author = "NCSC UK"
    hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
  strings:
    $key = {31 42 31 34 34 30 44 39 30 46 43 39 42 43 42 34 36 41 39 41 43 39 36 34 33 38 46 45 45 41 38 42}
  condition:
    (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $key
}

rule nautilus_common_strings {
  meta:
    description = "Rule for detection of Nautilus based on common plaintext strings"
    author = "NCSC UK"
    hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
  strings:
    $ = "nautilus-service.dll" ascii
    $ = "oxygen.dll" ascii
    $ = "config_listen.system" ascii
    $ = "ctx.system" ascii
    $ = "3FDA3998-BEF5-426D-82D8-1A71F29ADDC3" ascii
    $ = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x0000000000000001.db" ascii
  condition:
    (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and 3 of them
}