2cba72a1da603dec8f391e76661eb218222741a789ba81fae3ad75c10bfab658

General

Target
neverlose.rar
Size 105.0MB
Sample260820-waj1dasdng
SHA256 2cba72a1da603dec8f391e76661eb218222741a789ba81fae3ad75c10bfab658
MD5 541363b3830808cdf2d20fb5ac045c8e
SHA1 51ecf66c85bdcdb74fd141b8a4132db36ce13dbe
SHA512 8bbf57ce29e1bda4ba069b1922bce141b343d57309121e91a47208ccbf31dd47e29e592691e30bbac14e3fd2c0c36a14e9f9a5060e62a062d297f3c1bde62375
SSDEEP 3145728:fg4/6oNeTxJdttFxH7bqehCij7beoHvwD4mzaVSugLZVRa:fg5TxJdl57Rgij3vwDtzaVneI
TLSH
T1B038332AC474B8CA201388D667D6E798EC9E7F7322D3071EDA13E3D8846593FA95F144
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  neverlose.rar
- Size 105.0MB
- SHA256 2cba72a1da603dec8f391e76661eb218222741a789ba81fae3ad75c10bfab658
- MD5 541363b3830808cdf2d20fb5ac045c8e
- SHA1 51ecf66c85bdcdb74fd141b8a4132db36ce13dbe
- SHA512 8bbf57ce29e1bda4ba069b1922bce141b343d57309121e91a47208ccbf31dd47e29e592691e30bbac14e3fd2c0c36a14e9f9a5060e62a062d297f3c1bde62375
- SSDEEP 3145728:fg4/6oNeTxJdttFxH7bqehCij7beoHvwD4mzaVSugLZVRa:fg5TxJdl57Rgij3vwDtzaVneI
- TLSH
  T1B038332AC474B8CA201388D667D6E798EC9E7F7322D3071EDA13E3D8846593FA95F144
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1
- Target
  neverlose/README.txt
- Size 50B
- SHA256 91b23669e08db33db6948e90f302912e251905a01da2f268d141a34e5c3abd5c
- MD5 8d192ae05f849236a281ca152a2acd70
- SHA1 5e0b371d1861830176836ca61c21779ca87b581f
- SHA512 88d94af7e6b793713ce411efbe937166de8d8e3cd02ff78498a13f0b2c196a09e18069f6fc5b5a8d72fc543d87aae8d45df7a74eca6c85c32dff6f15232b06df
- TLSH
  T1A09004CF115F54DD4D7101F13414FC5C00051404341145C53707430D1774777D01C310
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral2
- Target
  neverlose/craked.exe
- Size 70.1MB
- SHA256 81e41e2b40e105f8ac24907e1478aadf1cfd6df38428f0fcfb0f7d9a4946aa40
- MD5 6d1e919a3e0804c2e522162217882f10
- SHA1 317e83c42f3cf59dd7658689b789587fab08e6d4
- SHA512 571df754ead6844c4a56548c137f7284d65e07592c43411fe26e3e9b6f197a96d7ce5ae79853661432fa54d080e509443d3be537748709a612d50acf1caff6e2
- SSDEEP 786432:VGLHhsFd+U4DVOK33ZiSOH0q4DlpFcz7yk:VeSFdX0Zi0ySk
- TLSH
  T106F7BF15E3D84B16E63FC2BDC2638512E6B1B8531351D7CF0498DE992F63BC1AB36262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3
- Target
  neverlose/nl.exe
- Size 80.8MB
- SHA256 16b0a73756f9489ddc32b402f70192925afe8ea4b52d1b53c05f356a0c220460
- MD5 ea2da487b01c033c00e454e49746f7d7
- SHA1 a4e5c744deb7b7cd44d2b7831a14008a6230f44d
- SHA512 afdaf7bf5a5a25306f52983f828fe63e27909e526c56b4b46e4dae629f49d7803916a2c8ad19ee2b64b95a2d1fe0c1449d35921a0040cd39729b436e1fb88bd6
- SSDEEP 1572864:paatLozqmx/G3YUzqSF3v2GU8IQELiDSG4N/l7tYqDyd6uz7:paaZo+mx/kYYrF4QSxGI/lFOz7
- TLSH
  T15208339A8D004553C3147EFB4DD0AAB9D49FEE1F7C24FA699A2D70126B73DEC3068612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral4
- Target
  neverlose/patch.dll
- Size 84KB
- SHA256 1030094a28541e2d5ee72ee66ac180d5ffffc514e01f2aecb6079d8dff32bb87
- MD5 ffd1833f1faf3600d8995266cf91cb48
- SHA1 db1b71f15acf34ee6e0ca962ea977ad5482012e4
- SHA512 7ad4b327797e9d680a1518847a0752fe388cee08bea3054f72b2b6844d001530a44ede86b000c0f78638b42cff3d5042add2498c79c1293ab58321139a356a32
- SSDEEP 768:R/SCBH7LbfghT7c64RynT43KJis6mhsDh2u9WsK8My3k58vEMis9Vj/rUVPZl5+:R62HbfyEyi1hLDhFBK8tk3GPrUhZlY
- TLSH
  T11B831A5E72A434AAD4758239C4A34B15E3B1F125272247EF02E1C2BE5F13BE52E39F91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5