fa3a986c46fb6a766c8c1051cf38e8255571211fc5572b8b898f4b3759c0667d | Triage™

Login
Reports

Overview

overview

7

Static

static

3

neverlose.dll

windows10-ltsc_2021-x64

7

Sharing

Copy URL Twitter E-mail

General

Target
neverlose.dll
Size 13.3MB
Sample261030-13advsfv2z
SHA256 fa3a986c46fb6a766c8c1051cf38e8255571211fc5572b8b898f4b3759c0667d
MD5 9e6a0447992e9a4b9f3897fc3fe6e312
SHA1 a6de94f53bbd519e5aded6fc6531d6988089d730
SHA512 8882ad7334779b82e31775c1b7d9243900d2d7419290c5b43573dad30dcb951812244e0b27c047239ed7f8e09e15a5959b779b0ce99b91c5e2d3fda476eb15b7
SSDEEP 98304:wFvdL8EdfyP3LIkZ80LDYbs/kPrJcpd62Ze0KOv2cr:wFdIEtKLhZ80LDgpTJcpdvvx
TLSH
T1A5E66B48735042ACC03AA37289979F5BE335F88447798AFB23B4025E1FF27ED5A7A511
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

neverlose.dll

Resource

win10ltsc2021-20260911-en

windows10-ltsc_2021-x64

24 signatures

900 seconds

discovery execution persistence ransomware

Malware Config

Targets

- Target
  neverlose.dll
- Size 13.3MB
- SHA256 fa3a986c46fb6a766c8c1051cf38e8255571211fc5572b8b898f4b3759c0667d
- MD5 9e6a0447992e9a4b9f3897fc3fe6e312
- SHA1 a6de94f53bbd519e5aded6fc6531d6988089d730
- SHA512 8882ad7334779b82e31775c1b7d9243900d2d7419290c5b43573dad30dcb951812244e0b27c047239ed7f8e09e15a5959b779b0ce99b91c5e2d3fda476eb15b7
- SSDEEP 98304:wFvdL8EdfyP3LIkZ80LDYbs/kPrJcpd62Ze0KOv2cr:wFdIEtKLhZ80LDgpTJcpdvvx
- TLSH
  T1A5E66B48735042ACC03AA37289979F5BE335F88447798AFB23B4025E1FF27ED5A7A511
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence ransomware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecutionpersistenceransomware

© 2018-2026

Terms | Privacy