Nautilus (73cb7ecc-25e3-11e8-a97b-c35ec4e7dcf8)
Nautilus is very similar to Neuron both in the targeting of mail servers and how client communications are performed. This malware is referred to as Nautilus due to its embedded internal DLL name “nautilus-service.dll”, again sharing some resemblance to Neuron. The Nautilus service listens for HTTP requests from clients to process tasking requests such as executing commands, deleting files and writing files to disk
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Nautilus (d8295eba-60ef-4900-8091-d694180de565) | Malpedia | Nautilus (73cb7ecc-25e3-11e8-a97b-c35ec4e7dcf8) | Tool | 1 |