Nexcorium Downloader Script Execution

Elgonad .@elgonad

•updated Apr 27, 2026•1•0•241

Detects the execution of the 'dvr' downloader script and subsequent 'nexuscorp' payload executions used by the Nexcorium Mirai variant botnet. This rule specifically looks for `wget` downloading 'dvr' from an IP address, direct execution of './dvr', or execution of 'nexuscorp' with an architecture-specific 'dvr' payload.