Overview

overview

10

Static

static

3

neverlose.zip

windows7-x64

1

neverlose.zip

windows10-2004-x64

1

neverlose.exe

windows7-x64

7

neverlose.exe

windows10-2004-x64

10

neverlose.pyc

windows7-x64

3

neverlose.pyc

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    neverlose.zip

  • Size

    9.1MB

  • Sample

    250308-qzgzesxxf1

  • MD5

    66f207494335c00358691dc7b59974a8

  • SHA1

    f58f3e58a65075a4a56b9024813c1bea16eb3424

  • SHA256

    7b32c1420987a465d99cc1f7331e6d8a53e2b8f3d975362f27179cba9a0b0508

  • SHA512

    5e8c1c78f5cf60664d04f421edbf1ae9b8b8f3897160dba9d92a6d4a1b401ddd2531249f495c8cf1d793231e484bbc4725c0d4f1614707c7343f5cf20541a868

  • SSDEEP

    196608:9Er8d2b+QsjXeRDEh2pH+DLdfx73nITh/PrWQIMgbUTPOZs1HnMjdon:91PeRDEhoEBfx7YThjWZb6Go

Score
10/10
xwormdiscoveryevasionexecutionpersistencepyinstallerrattrojan

Malware Config

Targets

    • Target

      neverlose.zip

    • Size

      9.1MB

    • MD5

      66f207494335c00358691dc7b59974a8

    • SHA1

      f58f3e58a65075a4a56b9024813c1bea16eb3424

    • SHA256

      7b32c1420987a465d99cc1f7331e6d8a53e2b8f3d975362f27179cba9a0b0508

    • SHA512

      5e8c1c78f5cf60664d04f421edbf1ae9b8b8f3897160dba9d92a6d4a1b401ddd2531249f495c8cf1d793231e484bbc4725c0d4f1614707c7343f5cf20541a868

    • SSDEEP

      196608:9Er8d2b+QsjXeRDEh2pH+DLdfx73nITh/PrWQIMgbUTPOZs1HnMjdon:91PeRDEhoEBfx7YThjWZb6Go

    Score
    1/10
    behavioral1behavioral2

    • Target

      neverlose.exe

    • Size

      9.4MB

    • MD5

      5ea9e8fcbd947d824f90c64310f5f408

    • SHA1

      19e126033e57b4431182434126e9f18ae58333d1

    • SHA256

      eddf7f2852cf1a14bd776ca6ecd067b9623e0dd113b09d80f054348f48cc6816

    • SHA512

      1d9e2b03a097c029fcc9bc48f971e54fc3eede9f5e3105b550d60d507bede9d15131635785c9637b84c686710b2bbd06a24798ac55f8a44621052df2ce0b6fb7

    • SSDEEP

      196608:iW8b88HkdgjXMCHGLLc54i1wN+mrRRu7NtbFRKnZMZDRxk9mhzTNzslBnTN1D:aceXMCHWUjurRQ7XbFsn6ZDko4N

    Score
    10/10
    xwormevasionexecutionpersistencerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral3behavioral4

    • Target

      neverlose.pyc

    • Size

      4KB

    • MD5

      2324fe98a9a3507a7dbb3cf1baaaed32

    • SHA1

      9bc10d775c286db0935320095e5a5d2962e5ca4b

    • SHA256

      2e4121fc6ddcebf88f251c9bfb128a5864b5aa9a40c013d0ed51c575d7518d95

    • SHA512

      a4662741097e20cc00556b9fbd295d5af10059569ae2f5d80b32545dc9edd73e3c27d44f13832fade48940097f6578434a4e7b5c4808f8f3b06797a0f536c7be

    • SSDEEP

      96:9YcShc3B0tvpcAv4Nht8GZFbs+ZCiixuL672S:YGStKAv4/5FbxbI3

    Score
    3/10
    discovery
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks