12e363e9232c6d8d17a97ad37ef0c55cd7edc88369f92b165b919ac1e8467f2b

Sharing

Copy URL

Twitter E-mail

General

Target

NeverLose_Free.zip
Size

81.5MB
Sample

240404-zzxvbaad8x
MD5

5c7b0ad894cde9a43be9dac5f943f689
SHA1

5c5868ad8780307e55d56ca4906684a6c885a282
SHA256

12e363e9232c6d8d17a97ad37ef0c55cd7edc88369f92b165b919ac1e8467f2b
SHA512

ab2a7b33a1ced1919d68f6df0e681d4af2cb32d15a9b468a9cae4697f89e7a1fce5e272eeafcad6443bf502cb728bf0e06ca8940c35b4bb3adf758b68568b610
SSDEEP

1572864:iZgzBNBnDsphWAkfyHXhcRiY1FQpDIRnnHkqn3K+gOuxq0pW4h:iZ8jBnDsphWAkfyxcRicFA4naxOuxq0T

Score

8^/10

Malware Config

Targets

- Target
  
  Launcher.exe
- Size
  
  81.5MB
- MD5
  
  442c69cd61c620db766ff2e6765d5426
- SHA1
  
  1e8d3c52c71344c8e026db4e1a9d3173dbc2a298
- SHA256
  
  3c31b92098f561f07db72cf527e512a85f0b10d55cf15193a38012b9d252a8ab
- SHA512
  
  a0f07ec0a89b5234e52d7a3c49eb7625f7ea85f5f0e6ffab6363de8a78c5cca05d1946cddd0794ee14d046d70cba1490329748a328eceb0c6a35644ded7e9df8
- SSDEEP
  
  1572864:K/WHHr9fleJ1IsiXTq/p0Q4zz6z3yzPgxTTB0KHP4KkqWTE47CW7:K/8L9fleJ1IsiXTqRF4zzs3GEHwNqWT7
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral5 behavioral6
- Target
  
  LICENSES.chromium.html
- Size
  
  8.4MB
- MD5
  
  e400cd908b8fb7c13985e2f5cc7a7044
- SHA1
  
  bbafebdf5b067a7d7da130025851eaa52ec3c9d7
- SHA256
  
  ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
- SHA512
  
  e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e
- SSDEEP
  
  24576:/UrV6CI675knWSgRBPyQlrUmf1C6C6y6Z6/678HqBMUpuQ:MsWKA
Score

1^/10
behavioral7 behavioral8
- Target
  
  System.exe
- Size
  
  158.3MB
- MD5
  
  723d21949031d36d1908be96be43b4c4
- SHA1
  
  c4011a6cef6e1f370626257cc5dbc5cc1e03f037
- SHA256
  
  ec3bda8d5f0201c13fdeeedfc6968703b9d655e5b009845fb687e5b7271e8d89
- SHA512
  
  9c4d2ddac85acd3dba7e6a5ca1f321eefa0d040d5a4d120df5e608f30f67aecd876964198aaf549cd96ee2cceb67f31f54303999cd4432f4d76a712b51c9cd7d
- SSDEEP
  
  1572864:UatFKZwMtLYWQwZOTACYItd+qy9YN6yxL+a6ZqbZX5OG+hJfROyOe/FkCX3cIwvI:viQ08xye4
Score

8^/10

evasion persistence spyware stealer
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral10 behavioral9
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral11
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  88f6f9d61966ae8b7551b0551a64700b
- SHA1
  
  c88dd63397ae431c240570e867b0496a548fed84
- SHA256
  
  3eadbb2e0b7cbfbaeea4b89cea57ad05ed7e0d2e2196c3b2e6225a6f99ba9755
- SHA512
  
  9666ce9457fb3a9a98666f1cd9c18c5c7eed5baa506a8e9fe262fba714269c7c208dbe12015f248116b60aeab4c3f8260b9ed73f90e71b85bdd972ff27c5f078
- SSDEEP
  
  49152:s8h7ilnY895zc09Myl6QL3n6F+hTf6yfPvJr8PNStFwLluJMWykOFc:2n1H9MDCn6OFMWyBc
Score

1^/10
behavioral12 behavioral13
- Target
  
  libEGL.dll
- Size
  
  469KB
- MD5
  
  83ac3fb31b419b68e20b120077a8a623
- SHA1
  
  c9fce6914cd0901ca55bf7db6935ff5313ce1f98
- SHA256
  
  c359cf4f88472a3a79313949f15904731de53e18867b155b95105d4ef9d3420c
- SHA512
  
  a2937ead5e41ff0f68308fa26335c28ae85d22f53963918661b5882068969adae73341be75b15942c6577967667cab990690c6e4514f9ebeb92a4395ca40f1eb
- SSDEEP
  
  6144:bI9l960ewE3X883ZrzMkBmi12EvUGsADJIgHc:bClY0WM8JrzMIKODJ
Score

1^/10
behavioral14 behavioral15
- Target
  
  libGLESv2.dll
- Size
  
  7.1MB
- MD5
  
  9eb2566eabdbc1004da789923e21a53b
- SHA1
  
  1c8bac1f1c31ce184611e1796895d09eb4138a87
- SHA256
  
  b10186112042f3efd83f988806635490ae14a8fc1e631e91636e259d44a65453
- SHA512
  
  4b38f8898a630c3dbb9ea4726dacbae371ede2cf1ce48d4709d487094b9baca47edf73e2c7a69a35f3caea876ae8bc2d52c2104111b47989b7943b9288147504
- SSDEEP
  
  98304:2AgpTkR1+f1SlkWW6yAKwCD2x9Stm5H5wXV/J:p9nSYxCdcK/
Score

1^/10
behavioral16 behavioral17
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral18 behavioral19
- Target
  
  vk_swiftshader.dll
- Size
  
  4.9MB
- MD5
  
  679a2f8dd4d760acbb9ea11042b34f4c
- SHA1
  
  d9622a11e078168a51b60edc39fd1bd5aab81587
- SHA256
  
  2bc9336e1abd50984a2d5a144bc6360119a0250f73658555c3c6d2d71ac3087b
- SHA512
  
  959c0c5b8a24dacaf8a69dd14e09a039e6e0762684c0021032dca3962344fe3f382800f72f3ebdca0e3a7c8a226d57df515a80c9d3d8c2733522c5ed1df5ca36
- SSDEEP
  
  49152:P6PkZFjKeDTIEvAvlo6coVQxa8sVr0yN1J+MuXy557nDOPNt7wpr30sN+05uQKYz:PNZFjAgpOz2VeCCAkEvkCvGZx9z
Score

1^/10
behavioral20 behavioral21
- Target
  
  vulkan-1.dll
- Size
  
  917KB
- MD5
  
  efec2cf9ea038da005cbf1f1887a8207
- SHA1
  
  a64f9d2da2c480eccbee21ab6a6401770a965dfd
- SHA256
  
  2006ce9d935cf037bb9b8332cd74016c88c96cc727c2e9337eaeea91f8aee5a7
- SHA512
  
  ab0d15c34154f0813c993b707871d8e1881975c17c5a2eab3f0ea6492dc9f7eef621786c399d6d7bdaaff91cd09ef6520d6d42d773787ef8dc75c2d9a75b372d
- SSDEEP
  
  24576:UV9nIy2kwpHHPDnCo3A1XpQ66Z5WoDYsHs6g3P0zAk7EG3:gt2zNLnxA1+66Z5WoDYsHs6g3P0zAk7H
Score

1^/10
behavioral22 behavioral23
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral24 behavioral25

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Disables Task Manager via registry modification

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25