Overview
overview
7Static
static
3NMSSaveEditor.zip
windows10-2004-x64
1NMSSaveEditor.zip
windows11-ltsc_2024-x64
1NMSSaveEditor-4G.bat
windows10-2004-x64
7NMSSaveEditor-4G.bat
windows11-ltsc_2024-x64
7NMSSaveEditor.bat
windows10-2004-x64
7NMSSaveEditor.bat
windows11-ltsc_2024-x64
7NMSSaveEditor.jar
windows10-2004-x64
7NMSSaveEditor.jar
windows11-ltsc_2024-x64
7README.txt
windows10-2004-x64
1README.txt
windows11-ltsc_2024-x64
1General
- Target NMSSaveEditor.zip
- Size 66.5MB
- Sample260819-145w6avbkd
- SHA256 f57c2979ee6a498cd7d38d9587b23d5308023b113494043626732a1aa366e6cc
- MD5 632ba2d7cb488a1156dcb45fa21ae715
- SHA1 f73f5d0b16e4f43a5fd466e5effd7c4a2fa8cc7f
- SHA512 f4623b314341b1f0bcd77caec2a497b1d5b2249d3d11cccb8004ca2966cc8030c2c3e3264a14be0f00223b00ebcbf5a64d0dfa837e5de950e48e61f327eb4e6c
- SSDEEP 1572864:0m9WmLn2CbJUvpUFQPp06xbVKng03t/g5w1f49X667rRoFZwW:99j2CbJzj6xpYPidrRoFZwW
- TLSH T14CE733E227F0588E4F19792121668E83FE3D1A7D81B24ED4FBA12F74B6275DC4921B34
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
NMSSaveEditor.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
NMSSaveEditor.zip
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
NMSSaveEditor-4G.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
NMSSaveEditor-4G.bat
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
NMSSaveEditor.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
NMSSaveEditor.bat
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
NMSSaveEditor.jar
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
NMSSaveEditor.jar
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
README.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
README.txt
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target NMSSaveEditor.zip
- Size 66.5MB
- SHA256 f57c2979ee6a498cd7d38d9587b23d5308023b113494043626732a1aa366e6cc
- MD5 632ba2d7cb488a1156dcb45fa21ae715
- SHA1 f73f5d0b16e4f43a5fd466e5effd7c4a2fa8cc7f
- SHA512 f4623b314341b1f0bcd77caec2a497b1d5b2249d3d11cccb8004ca2966cc8030c2c3e3264a14be0f00223b00ebcbf5a64d0dfa837e5de950e48e61f327eb4e6c
- SSDEEP 1572864:0m9WmLn2CbJUvpUFQPp06xbVKng03t/g5w1f49X667rRoFZwW:99j2CbJzj6xpYPidrRoFZwW
- TLSH T14CE733E227F0588E4F19792121668E83FE3D1A7D81B24ED4FBA12F74B6275DC4921B34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target NMSSaveEditor-4G.bat
- Size 178B
- SHA256 8c6d48baa19942f238869f2f0c33afad1658f4982e9c683ed77ed55fe4319e05
- MD5 653c6e5f1554a605b582f64511e1b95a
- SHA1 0885cf0f1039b36e29ff337b62f3039ec0d8ee54
- SHA512 dea22b0aea8909c6468aeacf288f13a54b064df8f84379934a5effb98ef86361f6fd6c042ee5e2b2737f339e5f3065e0ce929f9e8898b5dcee92b48511e7fc30
- TLSH T17CC0127F6070059F76B4155AE1274674967DA99AA878819034D0BB803EA14425B46C92
- MD5 SHA1 SHA512 TLSH
Score7/10-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target NMSSaveEditor.bat
- Size 169B
- SHA256 eab682ec4396f40a49fef91b403993d592926aee93234e38aca6595a1c6e5b10
- MD5 6b134a2093f28f7b693a7f515b1eed94
- SHA1 ffb14c88b4b80cdaa617399e04fade488d4bba97
- SHA512 4d2ba71573b0312dc03ffc38e80b59e98f1f455857de212f81be1ee440cbea1bcda349b3195cb8d54a10ef0e8796fa37b22c49a506e4c1c23cf5cc24cc39118e
- TLSH T16BC0127F5460059E7574054696224674567998DA987CC19034D4B7803D914821B46C92
- MD5 SHA1 SHA512 TLSH
Score7/10-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target NMSSaveEditor.jar
- Size 67.3MB
- SHA256 ef898af4e1c4c0c25a6c6529dfea52520cda243383544d8d358ad10aae3a178c
- MD5 3d56431974b94959e5a52574c56dcf55
- SHA1 532f36cbf3dabf5a3ac333605f05c99a26ea5444
- SHA512 ae8b7645eab121b8e16bfcd6f7d2b8b4625df5e62c909a0c2930c1ec3d395cd6c73931444d086b390e06be2ff766d874141a30dbcd26d86197da80c935082edc
- SSDEEP 1572864:j4qjy8pqEBYQY0UVZ+FK5gZo2meXNsOSTQKy+Rcl1xMu/wk:j7jEEiQOVgA5NWSI+RGxMuIk
- TLSH T10BF733E393E0545EC65A8572D1262C43BE2EA6FE94367A8427F079B13D7AD084B73334
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target README.txt
- Size 489B
- SHA256 3bd61e15af99fdc4afa64402f758deaa76048aec3590fd1d4e02fb8ff6047a37
- MD5 0760d08e9983cd8ec70a352fee535021
- SHA1 a039feebc9121cda9f7eec00c8971ead5ae0c2bb
- SHA512 ee918d0dca23b7d73e7163773e1a07fcb3e5fc27e0acb7d7b2d0a2dfede87ff68e0d2158ae9b88400d5d9991656f5e1d129550e7f8637341fd309f74cefe9c66
- TLSH T161F09ECF6E1701143AD404E0846A9561EF225868E6DAD86535AE918D2653192436ACBD
- MD5 SHA1 SHA512 TLSH
Score1/10