General

  • Target

    NeverLoseClient.zip

  • Size

    3.6MB

  • MD5

    37219fbedef9c0a1d56912d7dcef84a7

  • SHA1

    2280f28178322e4e1ddf0a104fa236756e60ea31

  • SHA256

    aa51f5e413b771a6ccc4dc9665571b6264133852df96ded99ba66ba2cc56ed6f

  • SHA512

    f757d65cc98cdabd84fdcc5d3d803fed9cf0b48c1b27905c25063d1aecf03b0940610650415fc1807da6b8a22d927023cb165b1feab3dcd73ad177b15a39b7a1

  • SSDEEP

    98304:v6PMt4eAwP3dcGLyKGYUZMr+lV6aMCUO1E2djrhk/ZNlE:v6BeAsdlc/qW7tUO+2Zrhk/Z8

Score
10/10

Malware Config

Extracted

Family

xworm

C2

plus-improve.gl.at.ply.gg:2705

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    сmd.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • NeverLoseClient.zip
    .zip
  • NeverLoseFree/NeverLoseClient.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • NeverLoseFree/bin/Adb.dll
    .elf linux x64
  • NeverLoseFree/bin/AdbWinApi.dll
    .dll windows:6 windows x86 arch:x86

    776334619bd19ec23e3a7a275473b5a7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • NeverLoseFree/bin/AdbWinUsbApi.dll
    .dll windows:6 windows x86 arch:x86

    72b8c869f01047191838df5f58e88dd8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • NeverLoseFree/bin/adb.exe
    .exe windows:6 windows x86 arch:x86

    e6e69030c3a33898b09715b432c51499


    Code Sign

    Headers

    Imports

    Exports

    Sections