2c233e131540d7f1740edbefa5fe30b9d7c81309601dda102889ef8ee9ad6d89

Sharing

Copy URL Twitter E-mail

General

Target
Neverlose Loader.zip
Size 11.8MB
Sample260703-raba1sav3v
SHA256 2c233e131540d7f1740edbefa5fe30b9d7c81309601dda102889ef8ee9ad6d89
MD5 c8a197f873d813c35f384c12befd1d0c
SHA1 f9f42c4ef6668d2be21090d0e38a74359a50720d
SHA512 c88f97ebb792e7c3d4c0ff0993e8d03187a6155dba23ec2bdd5227746727b74270a748e5aa6afd2ba7f1cdcc03dc2d77bc949288ea5b66704eb61f0bfa7d0cec
SSDEEP 196608:rL11NqScOl0iigQh9ioLy0mZQ8+ewKW5NQg3VqS3ASiQcHir6NDG46jJQtyJZTnd:tzqfOKiOmZQwwd5h0LQT8a4CQ8JZTLc+
TLSH
T19EC633ADE3A6185EDC35F03A243608D66B7F82C59174700F99A82058C4E8FDE47D67BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Neverlose Loader/Neverlose/Loader.exe
- Size 146KB
- SHA256 dd9729a2f62a8c742aacce3ee721df1cbd1ce549477decb3c64f9ed6dfb9c1ee
- MD5 301a5357ec4151273a737a57a211c7a5
- SHA1 482fe3a0f2e701c69f40134e71faf5c134cd1fae
- SHA512 db8bef0960722e0372e1af2eb8057ba7640dc140d5710f301c2896d997fb1222c645e0b3b7a5a138b8a0fd4a1a316cc71f305b9a9170d728a4851f2abfd76d89
- SSDEEP 3072:QhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxmhBuGEL/:QhK4XycqgpfCup5sVxuZ04uhAD/
- TLSH
  T194E34A43B2AC00FDE1BBA3788AA21906F7767859477197CF0390C56A1F67BD09E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fi-FI/NBug.resources.dll
- Size 5KB
- SHA256 953df67b57479accbb92435ac2d649d1303afa4cc07386f38a6261dd19a74028
- MD5 f12cfdeb44f4c05fa2a9d6fd17fc1ce0
- SHA1 e44de567e77cc20c7e456eb9f4977516d81d6291
- SHA512 38cf9d46d1a5d0715b2304b3b0be927a3ed42dd83ddfe144d223e76ac2f6b262344e7ed3b1375bba1b21d1973bd41a5d80089c9a279aeac53f112746853fcf0a
- SSDEEP 48:6IYVHMoM4Oq2nvb6FtoYZlczTI0emqIJKqw6i5apxilt4uSCkmzJlg9XVyqklZK0:uVI41W8FRltpLPuKrK
- TLSH
  T14EB11F12A3F8466CF6F30F727DB263854177FDC1DE228A9E055412AD0D62A918D72B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/BCUninstaller.resources.dll
- Size 92KB
- SHA256 6181a5e5b5ed12306414203a315b93163c2165a04d6a28fd43b3b717d30b40e4
- MD5 526f464dea5cfbeb949c0e9a7c5fc1f9
- SHA1 b9eb886128bf7c3c1461580ffab01fe78c01e6da
- SHA512 c6ad3bd3eb3bee6eacf3519ddc3ef302fbf6403b77454a78fcb9bd2241d6fd1dae49716573d65996a87b2be613eaa9d8b4a255baa22ea2c411c9473092ba0e7c
- SSDEEP 1536:FSt8BGjXPm4miaOH8MMZA/WLLd1tVETXKaI4ARKIj1X9:jBGjNkOcMMZfLLd1tmTanphj1X9
- TLSH
  T19B932F016FF602A8F6F37F76BA7695528837FD96AC21D22D4086054D02B3AD4C5A2F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/KlocTools.resources.dll
- Size 13KB
- SHA256 3a038916cb4f149bfdde66b4b1dc6d80958504d9dc1394582732b9b8111702e7
- MD5 95e7f7b7f2d5cdc5ba0de2e856828f3b
- SHA1 377c7088bc963abbdc6a3090d911e12d35bf7880
- SHA512 6d12d4c7e525cae6445d8442428c95f6839ca7e77db3921325487e7d6c5a9a0defc67ec3049e77be9c16135e9b3c5772285a7acf8a91358ffe5ca9be90469d2e
- SSDEEP 384:fbRpQhWNg+6OMbOZppfLxdNBDbPYaXIENR:bHaOZxdNaaXIEL
- TLSH
  T13E52702297FC05BAF1F34FB63C76A552253BFEA19931E21D4584110D1AB2B58CAE0B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/Microsoft.VisualBasic.Forms.resources.dll
- Size 25KB
- SHA256 a7a9401fbc17d52300f3339cc4c599e6ffad6bf041c8177434a4652d909fe632
- MD5 e08068a0300acfad54977c0a91c624df
- SHA1 ca08eea647cd5ff38e9175e0c3f230bec3e3dc4c
- SHA512 99c71ea8bfcd8fa4b98da96063986ee4e3b762d1907be12bffa94541dbbf3f74efcdfac3ba831dad3af0c07c322a075d62297e076140cfd1be3149cc10f6d366
- SSDEEP 384:ht0XSXRaRmIZXdXxaSiG7eQu0a27bVhr1FEhrJaWYHAhQ5WCpPDHRN7rTEMgYR9e:htpIzvB1LJFERDydXrgE9zS
- TLSH
  T1B2C20861A7FC0309F9B35F301EBAE5966D7EBAA66E00C51E0151924C4D73791CB20B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/Microsoft.Win32.TaskScheduler.resources.dll
- Size 10KB
- SHA256 2df63c99dc41e10c03ad99cfb7e8cf0147b656a075134427f0b86c7494cd5163
- MD5 9a82d7e543aa82f9fa9dbadd6328aa32
- SHA1 85880304fb526dcf60c066f779dce814ba463f89
- SHA512 9285865cdab3d48434bac5ce6a623b9a6b298e76e0c2c9cbeff84c10734c41e3d260bbcceda2f368eac94ac5f4125469f3e559a7f3de9a3710f101be35c8d8cf
- SSDEEP 192:MWWNv/jzSEYtPpmKJiDjgmlRFI0HYZDKz/VAfa1p5rAM0XWr:M1NvbdKJiDjgmlRi0HYZDjfu5rAM0XWr
- TLSH
  T19D22000EA7F8162DF5F22FBAE9768532F83AFDD59832C5AD0644810D1531A41D6E2B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/NBug.resources.dll
- Size 5KB
- SHA256 2c37b1e6a8cd219b228611ce724ae1f9f13bc88233c298f8b681fcc9faa7ee90
- MD5 d2b1f2a6bcae3e06be486fe5cbe8c0ca
- SHA1 11060e47d1ec8c9f0f733c074388d5366f5a84c3
- SHA512 9b9c51ee2b1ad0e9f833d4195b23b77467a3056a60cac71b785bb4d556a32c2afb11508df4a8d072025ddf964965541f73eb285ab5d6d0230b107542b1a1e286
- SSDEEP 48:6BfHltMVxHAfHMoM4Oq2+1bTztx3lYz6zI70mePpMaOdivlc4ufnSmzJlg9XVyqG:yXCKfI4PIcpMmlcpvhOKrK
- TLSH
  T1D1C14283A3F806EAF6F30B777C75A3841177FD98ADB2854D0450529D0C926588F71B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/PresentationCore.resources.dll
- Size 110KB
- SHA256 0291987fabf417800fa2ccdf82bbd27463031ff316fda0c580712f6d78763b08
- MD5 3c278ac35756662d102307ba926a4ec3
- SHA1 a4e5376a82a9c8f58e1e5cd5c384bc5073f9ce70
- SHA512 238b29fb13a7eb855a0f8fffe6643a6e2814402f32a0a279fe28c40587616711e1a6ced903f1e1cccf41a2bccb98b471b864440d2aa0674c1ac2d2e58cc7940a
- SSDEEP 1536:Y61jOFSVCiFy5rxLqHbTWd4l8PqoVzkoSKd12CcjE5W0+I2T7yLzl:f1iFSVCiFy5rxLqHHWdWUZ2CZHB2fs5
- TLSH
  T143B3C546B7F82205F5F32BB5BF76E516CC7AFCA92A01C11C0894818E05B2F94DA65B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/PresentationUI.resources.dll
- Size 45KB
- SHA256 ac2fff727aef3c61923e66d101a45817365d3ed1db59c61cf244c2c41961646a
- MD5 add8981d8e0b808b16a6665eb3f5c370
- SHA1 08bc65e313531ad6709da230b1c25d1e45398303
- SHA512 ce23a2abdb34f2ecb061cb0524afdfd923657313ced00af784bc74b4f8c98a1401749875abd55d49bf724b87d06a382971103ef682e05c5b013f5fb9c4370cca
- SSDEEP 768:0+pAJgb7iRNnCU0ZPx7LZ7m8cqj3ufSgIPZxXYJmR4D89qPiDddnRF9zU04:l2Jgb7ik/m8cqj3ufSrPZxXYJmR4DenE
- TLSH
  T18C235D6AB3F81149F6F30BB1BBB594969C3BFE56AE02C10E0469514E0572F84CB607B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/ReachFramework.resources.dll
- Size 39KB
- SHA256 82be3e3332c268ea9fd849e309a91a0a74adb9131adda37520b47c41069ef257
- MD5 f83d7d0eaeee28e401865746267bc7cf
- SHA1 0a6071e29903405b16087c9c3b4686c5944508b8
- SHA512 16378973c7c6239ad7887b4af42aae92fc39b0b1d4cb659b9002a9882bf6e4425fdf23ff1d503a22a88ea34f07d62648548252823fc211321bc6101ed173853f
- SSDEEP 768:3ppgsqCekJO+Ym5hLgEPH2UpYsMoj4KYwqxxSOHpVCNDJuLwt3YHZts0/rshznp+:PgsqCekJO+1Ym3Y5tspSgcO3Xb4ynz2
- TLSH
  T145039346D7F8164AF9F30BB0E679D0036CB6FDA56A00D62E1198E04E0472F58DBA1F76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/System.Windows.Controls.Ribbon.resources.dll
- Size 18KB
- SHA256 20971224a229ff79fdc68051757fd0c3de92f406dd8ecd34927d32c7657410ac
- MD5 4478ac01868eda48fa95e50c6f0e3616
- SHA1 9083f3a747f58c0ee8cdc4872dd68ed0c51eeef8
- SHA512 6188c0f41781903744dbea9325c52fcf1c92c13e7b420950e47833a87c82969e61bcc1a249280e2155d1928db7ba76d7be162f739ed508ad6b0ef9e9a7264a8d
- SSDEEP 384:d2Qhg6wkkoWWm/hljHRN7Q7l8BR9zMUTre:d2Yvwp8mDjp9zvTre
- TLSH
  T1E28208528BFC1202F9F31F706779DA92AC3ABA917A00C15F0595F9490DA3784DB21B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/System.Windows.Forms.Design.resources.dll
- Size 146KB
- SHA256 bfeca9bad8a404c693368fbe821b66a52c73cc73cd6374d48f5fbfd20e250cff
- MD5 975ba413e8353b9a130ad3685fa59065
- SHA1 d6ea90143db0ab1f7a37de6fcd22738d85c980e2
- SHA512 3bff7289d3a462ba355cb2d145fd5d58145fd1231b017c429bd355e85e183e55e9af2034ee285bf017786e77aec68c0fb652d609bc9126dcbd5299f2e0156226
- SSDEEP 3072:1R9MtbGzbtyHZ/I11DKdwWorcP4IVCcPU9yhCfAcGtexgaNPKKjBHIpC4GdWKfqb:FWKfPZAYt1vDECg
- TLSH
  T1F3E36F6127FE2309F5F36B706FBA81818E7BBD77B900C62D1025155D4A72A829B60F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/System.Windows.Forms.Primitives.resources.dll
- Size 15KB
- SHA256 409cd80fae33e3e5ebc166d650615e1e4891df91204de43959fbca14644a303b
- MD5 dc6601f5131b314e994e05dc9d0e35f7
- SHA1 a1bc05a7c8f98ed5bfd1b3f31709f431ae5db8ac
- SHA512 f27cbad5836d7dc1c3102e913195d6cb59b8728b6c8bd0a1c0facdb37106ed9bdff2a9b463f2c661c3c3f5a9d0957f4cf2cf56862109322768f7d6cca8fda714
- SSDEEP 384:VO60NvCW9iWI/hljHRN7CRwGOrjR9zbuIUs:VkNBUDjCRwGOrF9za9s
- TLSH
  T1AC721AA187BC4247FCB75D70AAB5D5432C3C7BD26D50966A0591F5480CA3381EB3167A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/System.Windows.Forms.resources.dll
- Size 364KB
- SHA256 f88baf98347bba15d89cf49427269fb23fba24c69783971c632dd001705a6a84
- MD5 f17dd8ce6a009facae40433eb3b16f0e
- SHA1 76161f3ad52902ed5b84c8d5320ea0235e00c23d
- SHA512 1db0f58d797d1cb28c72d57b8f613235cd13eff3f1ca8890b27c6178868d10627656fcdc422d0b7edf6b34b1e3c5915221d528745cc4d27239cdb9cbf4a4329a
- SSDEEP 6144:wqcPiurmC0Boo10ET1JufIpfR03Zu6tTOnSLgO/c2m+hi+fBMcGMOfS:wqcPihOtT+SEO/pm+hJf+cGMOfS
- TLSH
  T19C847404A7FC2348F1F31FA2BB729552CD76FD652E06D65C086441CE05B2E98EAA2773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/System.Windows.Input.Manipulations.resources.dll
- Size 16KB
- SHA256 a85b4d460063d0b98baf36d279d13b37b46be0d031a913c67721c5a6af0b2ab4
- MD5 90ff7b9b18ac5b2dc024062125e9a766
- SHA1 58ed2f7e7dd8a6df25768c8ade48899ad9c3dd51
- SHA512 3f22e34caac245e555103e25b6fa221e41968e41462ea7545519c6dc76d4e84a077b0786f533087eb4cb6b0ede2ef61eb23ef072457f8dd319c773d0e18dd863
- SSDEEP 192:gHqGotD2NfZG2CEucQ9UWifZWQhFJtvUmmnoHnhWgN7agWKOxo+DF9X01k9z3Agv:gK8ZbaUWif/hljHRN7mp9R9ztN
- TLSH
  T1EA7208A293FC4543F8B75E7056B4D9533D39BB9B2D00D62E0A85FA481C63780AB30A7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Neverlose Loader/Neverlose/win-64/Resources/fr/System.Xaml.resources.dll
- Size 65KB
- SHA256 c58c0d2145a923f17a45932feefbb6d9a584fdeeed9f7f09c67193bc07008816
- MD5 cbffa99d75becebbba929d0587d3ff1e
- SHA1 d04f6c0cc05286d42fd3b4405182ae7edf802b70
- SHA512 e20147104335e1cec7fcf412908df4c99ac178a31a61c5f0b48e7141859322a17407062f3dda4d53973c63c52bebc8219c04941e48f7dd37501af4313a2642a2
- SSDEEP 768:VRZOvnRva+O3yc01mDJw5snyPIX1l1/qC2Od1pRQXi/YiWgpgDjeW9zo:IvnX5+yC1l1yC0SbtpSeizo
- TLSH
  T1BB63D94AA3F82215F5F31BF4FB77E90A8D79BD292701C41C8494414E02A6E949B37BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32