Malware

Neunative

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1112Modify RegistryEvidence1

The usr and userid UUIDs are generated once with UuidCreate and persisted in the registry at HKCU\Software\Neunative under _uuid ; the inst UUID identifies the install.

Stealth

1 technique

T1036MasqueradingEvidence1

The SDK contacts lb.gmslb[.]net:443 (TLS) with an HTTP GET that reads like a browser doing its best impression of itself... The Accept header is pixel-perfect Chrome... The User-Agent is SDK

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

The usr and userid UUIDs are generated once with UuidCreate and persisted in the registry at HKCU\Software\Neunative under _uuid ; the inst UUID identifies the install.

Command and Control

6 techniques

T1071Application Layer ProtocolEvidence1

For each peer server, the SDK opens a TLS connection on port 6000 and speaks a proprietary binary protocol.

T1090.002External ProxyEvidence1

Bundled in the same installer, registered as a NuGet dependency, and activated whenever the VPN is not connected, is Neunative: a residential-proxy SDK that turns the user's machine into an exit node for third-party traffic.

T1090.003Multi-hop ProxyEvidence1

T1090.004Domain FrontingEvidence1

The hostnames in peer_servers are rotating front domains. For a single fleet the director returns both sN.viki-play[.]com:6000 and sN.star-layer[.]com:6000 ... The sN identifier and IP are the stable node identity. The domain is disposable.

T1105Ingress Tool TransferEvidence1

Each OpenTunnel spawns a dedicated worker thread... The worker resolves the server-supplied target hostname with getaddrinfo, connects, and relays bytes bidirectionally between the peer server and the target.

T1568Dynamic ResolutionEvidence1

The hostnames in peer_servers are rotating front domains... Blocking viki-play[.]com redirects traffic to star-layer[.]com or whatever the next front is.

INDICATORS OF COMPROMISE

IOCs tracked for this family

56 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

50 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching56

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Neunative

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1112Modify RegistryEvidence1

The usr and userid UUIDs are generated once with UuidCreate and persisted in the registry at HKCU\Software\Neunative under _uuid ; the inst UUID identifies the install.

Stealth

1 technique

T1036MasqueradingEvidence1

The SDK contacts lb.gmslb[.]net:443 (TLS) with an HTTP GET that reads like a browser doing its best impression of itself... The Accept header is pixel-perfect Chrome... The User-Agent is SDK

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

The usr and userid UUIDs are generated once with UuidCreate and persisted in the registry at HKCU\Software\Neunative under _uuid ; the inst UUID identifies the install.

Command and Control

6 techniques

T1071Application Layer ProtocolEvidence1

For each peer server, the SDK opens a TLS connection on port 6000 and speaks a proprietary binary protocol.

T1090.002External ProxyEvidence1

T1090.003Multi-hop ProxyEvidence1

T1090.004Domain FrontingEvidence1

T1105Ingress Tool TransferEvidence1

T1568Dynamic ResolutionEvidence1

The hostnames in peer_servers are rotating front domains... Blocking viki-play[.]com redirects traffic to star-layer[.]com or whatever the next front is.

INDICATORS OF COMPROMISE

IOCs tracked for this family

56 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

50 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching56

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.