Overview

overview

7

Static

static

3

Neverlose_Free.zip

windows7-x64

1

Neverlose_Free.zip

windows10-2004-x64

1

Loader.exe

windows7-x64

7

Loader.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/app-64.7z

windows7-x64

3

$PLUGINSDIR/app-64.7z

windows10-2004-x64

7

LICENSE.electron.txt

windows7-x64

1

LICENSE.electron.txt

windows10-2004-x64

1

chrome_100...nt.pak

windows7-x64

3

chrome_100...nt.pak

windows10-2004-x64

3

chrome_200...nt.pak

windows7-x64

3

chrome_200...nt.pak

windows10-2004-x64

3

icudtl.dat

windows7-x64

3

icudtl.dat

windows10-2004-x64

3

locales/af.pak

windows7-x64

3

locales/af.pak

windows10-2004-x64

3

locales/am.pak

windows7-x64

3

locales/am.pak

windows10-2004-x64

3

locales/ar.pak

windows7-x64

3

locales/ar.pak

windows10-2004-x64

3

locales/bg.pak

windows7-x64

3

locales/bg.pak

windows10-2004-x64

3

locales/bn.pak

windows7-x64

3

locales/bn.pak

windows10-2004-x64

3

locales/ca.pak

windows7-x64

3

locales/ca.pak

windows10-2004-x64

3

locales/cs.pak

windows7-x64

3

locales/cs.pak

windows10-2004-x64

3

Resubmissions

15/03/2024, 18:57

240315-xlx7taac98 7

Sharing

Copy URL Twitter E-mail

General

  • Target

    Neverlose_Free.zip

  • Size

    81.5MB

  • Sample

    240315-xlx7taac98

  • MD5

    bd3060dbd3fd223e1f47cac635883376

  • SHA1

    4f2c38e570fc298d3e758bad2d9759733cb6e1df

  • SHA256

    1bec59ae5dc530ec12c1bc8c2dfecd7ef54c9061883153f3658784a43e142464

  • SHA512

    2bf191637b5ee47ced97a717dd907e07bb7337403a8fbb4fc96059ca58268893f9b81b7809437ac3fa16f42ba88a94d6b191648a987fbe4eedd361e7465d25b3

  • SSDEEP

    1572864:zZmzL7bCjrzmEr9GDdCkaAsXa9lnwPJCpNh1y05zQKGwkDYtvInu:zZOnbAzm49AdCXXa3nwK58VwkDYtvInu

Score
7/10

Malware Config

Targets

    • Target

      Neverlose_Free.zip

    • Size

      81.5MB

    • MD5

      bd3060dbd3fd223e1f47cac635883376

    • SHA1

      4f2c38e570fc298d3e758bad2d9759733cb6e1df

    • SHA256

      1bec59ae5dc530ec12c1bc8c2dfecd7ef54c9061883153f3658784a43e142464

    • SHA512

      2bf191637b5ee47ced97a717dd907e07bb7337403a8fbb4fc96059ca58268893f9b81b7809437ac3fa16f42ba88a94d6b191648a987fbe4eedd361e7465d25b3

    • SSDEEP

      1572864:zZmzL7bCjrzmEr9GDdCkaAsXa9lnwPJCpNh1y05zQKGwkDYtvInu:zZOnbAzm49AdCXXa3nwK58VwkDYtvInu

    Score
    1/10
    behavioral1behavioral2

    • Target

      Loader.exe

    • Size

      81.5MB

    • MD5

      33b0802c9a2a087744f2e5d447e23c55

    • SHA1

      feeb964c052aaf1ca39364217b336d8934901657

    • SHA256

      af277117f93fbe518b20b27504d9607df8389027daa848178dcf24355b33bd82

    • SHA512

      6319912cf946a66bd90c414f7fc7773a72d9f5fa4a0e651c3c06833b6573290d2ed2cb9990886720509625375a1d4f8ac88c88596753b96d94ab288e00f6c778

    • SSDEEP

      1572864:V/WHHr9kDJDEMtDY9TkfCtURGvz3yzPgxTTB0KHP4KkqWTEB7CX7:V/8L9wDEMDmTkHRG73GEHwNqWTEB7CX7

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral3behavioral4

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/app-64.7z

    • Size

      81.2MB

    • MD5

      a75b39f34e68bbc8cbfd3ab052f2d82f

    • SHA1

      819d65354842b94a61197aabbdac36fa4ab5da2a

    • SHA256

      30182400bd921a4fd054721efdbe80ca3dc955bf7acff06dc931369b4fc7dd31

    • SHA512

      2771193e3c782f21a3b6e481b1a9a9dd0cfb8bf7948771086dccae37dc22b1ed57702e677108dea13f30d1197b1ba5b6973e245f4283d5b5bd8b7fa441dd1501

    • SSDEEP

      1572864:C/WHHr9kDJDEMtDY9TkfCtURGvz3yzPgxTTB0KHP4KkqWTEB7Ch:C/8L9wDEMDmTkHRG73GEHwNqWTEB7Ch

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral10behavioral9

    • Target

      LICENSE.electron.txt

    • Size

      1KB

    • MD5

      4d42118d35941e0f664dddbd83f633c5

    • SHA1

      2b21ec5f20fe961d15f2b58efb1368e66d202e5c

    • SHA256

      5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

    • SHA512

      3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

    Score
    1/10
    behavioral11behavioral12

    • Target

      chrome_100_percent.pak

    • Size

      132KB

    • MD5

      e4cbb48c438622a4298c7bdd75cc04f6

    • SHA1

      6f756d31ef95fd745ba0e9c22aadb506f3a78471

    • SHA256

      24d92bbeb63d06b01010fe230c1e3a31e667a159be7e570a8efe68f83ed9ad40

    • SHA512

      8d3ea1b5ca74c20a336eaa29630fd76ecd32f5a56bb66e8cef2bce0fa19024ea917562fd31365081f7027dde9c8464742b833d08c8f41fdddc5bd1a74b9bc766

    • SSDEEP

      3072:TzwJCGIekwc9W2bg3yhPaL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Tzw1IekZ42k3yMK18Gb0OV8ld0GecQ35

    Score
    3/10
    behavioral13behavioral14

    • Target

      chrome_200_percent.pak

    • Size

      191KB

    • MD5

      99b95d59d6817b46e9572e3354c97317

    • SHA1

      6809db4ca8e10edd316261a3490d5fc657372c12

    • SHA256

      55d873a9f3ac69bbf6eb6940443df8331ebd7aa57138681d615f3b89902447e7

    • SHA512

      3071cfeb74d5058c4b7c01bfe3c6717d9bb426f3354c4d8a35bd3e16e15cde2f2c48238cb6382b0703b1cc257d87fcecfb84fbf4f597f58e64463ceede4366dd

    • SSDEEP

      3072:ZDQYaE/N6Mrvy/3JPD9W2bg3yhPaafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+y:ZDQYaSN6svydD42k3yxgx5GMRejnbdZR

    Score
    3/10
    behavioral15behavioral16

    • Target

      icudtl.dat

    • Size

      10.1MB

    • MD5

      62880b7d351a9f547b62b8da6c97ce25

    • SHA1

      057f11003013cfb3f1c63e6bdd4f2f9949ff0104

    • SHA256

      7c40c811d30d459dbf04a04c141b60eb4247cd58a008fb836605317df665748f

    • SHA512

      0d6f83175a91d90f4cc3ec4d9071b7acd0cd8ebbcc592322e46fde2adb7198e035af62c45a11a622f2a908e26d4dd8b8d1af023e634a74d0824d02c791ba3c1a

    • SSDEEP

      196608:1IPBhORjFQwCliXUxbblHa93Whli6Z86WOH:1kwVAliXUxbblHa93Whli6Z8I

    Score
    3/10
    behavioral17behavioral18

    • Target

      locales/af.pak

    • Size

      425KB

    • MD5

      d16ef573959cf5cf0a6eea20136b9c0b

    • SHA1

      e3384ae3ee92e1dae47a48e45589372e940aab33

    • SHA256

      73a8401e6dc17c4daf86b42c65b81359348f7e6b4d62d8637138e747bb3ff0ae

    • SHA512

      064c2912f766f10ec042adf82709ac9582cb8430e3550690fc17343c380dcbabadc0084e08aa5f3eb6faf79a652d26e1fe2606625a180b7f47808df07a566933

    • SSDEEP

      12288:yL0N/vpzXda2KCh2bM70i2Jyngy86BVCgIxHSt2lyV9V5t/te6AziApNi2:yL0FxzXda2LIbM70i2Jyngy86BVCgIxZ

    Score
    3/10
    behavioral19behavioral20

    • Target

      locales/am.pak

    • Size

      693KB

    • MD5

      39a396fce4d93f744b3c786d62d2686c

    • SHA1

      7ec8176e652b666b6ab9fffb6cb9b7dcfdd1a2a2

    • SHA256

      0b1d326be9dabcda8e37740017383f2d8f1bec7a8fdb1f11ebe538c3632453fd

    • SHA512

      798063b51f745fc2c9e7f852f72ce55939ed41305d070d1844c790755f7ab42a6830406ba2485237d37a0c46b804512e7dc37c65b7f03249c28741a4f706017a

    • SSDEEP

      12288:xzCqEYtxbGUTZwuMhqNx9TvLB/m/+9zT85J933Vw0upOAPxx30jH8+V:5CqpxSUTZsqNxlLBu/+9zT85J933Vw/o

    Score
    3/10
    behavioral21behavioral22

    • Target

      locales/ar.pak

    • Size

      758KB

    • MD5

      14b15761cb9d4e1956812df8b42c2aea

    • SHA1

      7c25580d892711b9eff1a3ace4e6699ea64e0706

    • SHA256

      c8d405127b032587e6ae6426a35cb766139bae26170ca08d811354486ab667f8

    • SHA512

      ec9a6e6e715c817726ad744fadca4d1af3015d95421774ccfe54d616225b7a17e862e086fe0aebb3a903d2ebfb27779cffcd713d3042ecdf9761c24c5a56cdcf

    • SSDEEP

      12288:OzoB4gW/B/RbVGQKvvYUNDjwkhb5YNip+olYMgSENX//:Ipg55X+L

    Score
    3/10
    behavioral23behavioral24

    • Target

      locales/bg.pak

    • Size

      788KB

    • MD5

      01dfb1a7815613fa0a5411235f45b27b

    • SHA1

      3bf1ea5597ac77b26bd30caa1efea7cb4f7a1b19

    • SHA256

      13d08d2c4972cd18bb8ea8a57587dad29684c2336f73282dd3284b0649377cf8

    • SHA512

      5d8a65e5a17aa163fb679e003e1837ea96e515b105c9977029a5ca4854845289de5d65c0edfd473cb74410c5cacdb5b360f25a69776705fb05f48688d92680da

    • SSDEEP

      24576:05iZCv/q5ftlYMdAs1axUB4x3aCKGtVDqSmvunp8dIO+5ZJquLRlbQDwN/6ZIQ6Y:0mCv/q5ftlYtUB23a0tVDqSmndIO+5Zk

    Score
    3/10
    behavioral25behavioral26

    • Target

      locales/bn.pak

    • Size

      1019KB

    • MD5

      ff4f966849b4107535e41d037d9144c7

    • SHA1

      3a973857b061914e8905bda7e8f2bdafa384588e

    • SHA256

      2dc26dee345271f4606650912b0b7b5df68f621f2920864e0e36c1d1b22459b1

    • SHA512

      98772f266f9553f77f91b11dc4589ec8a0930554e9e0b381bbacd8d23ce794c04f6fe821388a6e87cb14cb59c7522c18c06b1af11fc177c7e40ef71242adcba7

    • SSDEEP

      3072:qiTj8zSyVwde8yRWFyW2Ge/a/0hfI0PLvCIOvkMBbStDn5JiXlZ0:bTj8mySc8VcE8vBO7Bby5Il2

    Score
    3/10
    behavioral27behavioral28

    • Target

      locales/ca.pak

    • Size

      479KB

    • MD5

      a0b45b122241cf0c11a081eefb9cb4c6

    • SHA1

      91fd660a4688aaa70fee42e783b8b1863b4d11d7

    • SHA256

      7d911cda51564500dd7a6de43a1e347869427c035b15fa25cad0526be9e055b1

    • SHA512

      abcb3bcb96934189cdfd52528cd7c65ea870c9b997bf6349599b7064fe6f4bef0d34809f0f958e4d4e46486e7c0a41f86b5ed0a132bbf20743d41f3af64788b4

    • SSDEEP

      12288:k8E42a7G6ELn1R355PAF4N3Mw2juwHzejm0XNlGq8EmsTRvIs3cmlLEY0CJ7MyUw:iiQpDR+Vac/MNI5/EB5HTBaY

    Score
    3/10
    behavioral29behavioral30

    • Target

      locales/cs.pak

    • Size

      494KB

    • MD5

      1101c784521a550b0561b363722086de

    • SHA1

      838f2bfe3432b87b950a2ec5d9862d2f58fde3e5

    • SHA256

      cc6ff937d1c9fec4634db4e2f6c0718d2606fe2d5d25addf1314e110c5b78772

    • SHA512

      eca3ce2075d3c920116c9e34957631e0617a869467bb76b09873ae96f7803f20032a6dd0a0f785f9e59dcfce3a4ccecdab2d445a860bee20d42e140b45e74089

    • SSDEEP

      6144:MI6vfxlz7skzhZZD7ZUVNzrAMnz15/8VEgkNOQw3SBbY8Qm:9mbz7sobnZUVtRz15/8VEzNOl3SX

    Score
    3/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks