5cfb04b7be792e4d3c9d13ed5ea84560efd9137467215dd11fc51346dc76b19a

General

Target
NEVERLOSE.rar
Size 8.7MB
Sample261102-lr8d7aef88
SHA256 5cfb04b7be792e4d3c9d13ed5ea84560efd9137467215dd11fc51346dc76b19a
MD5 25b163ab877a9f404273801a270dd63d
SHA1 3df8bff90c2d690b9487c086d1f8edce2c121c26
SHA512 1a2dee0259ffe61116fe31b873008b1bb64c9de044d467b4b0ef2529c4841a73bd06baa055179a6dbdf28b721ac20cbbfaabf848ac4d86307653344ccb6f5dcb
SSDEEP 196608:GF2CcK4n7htNWD+fJCaJpu4Efm1rUeyFAn0wd:a29Ku1tNWqfxJs7qo5C0M
TLSH
T13F96331B4268576CFD1E74A6F610A62E1263B304ADBFECCDC86F3ACE8A7F959041141D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  NEVERLOSE.rar
- Size 8.7MB
- SHA256 5cfb04b7be792e4d3c9d13ed5ea84560efd9137467215dd11fc51346dc76b19a
- MD5 25b163ab877a9f404273801a270dd63d
- SHA1 3df8bff90c2d690b9487c086d1f8edce2c121c26
- SHA512 1a2dee0259ffe61116fe31b873008b1bb64c9de044d467b4b0ef2529c4841a73bd06baa055179a6dbdf28b721ac20cbbfaabf848ac4d86307653344ccb6f5dcb
- SSDEEP 196608:GF2CcK4n7htNWD+fJCaJpu4Efm1rUeyFAn0wd:a29Ku1tNWqfxJs7qo5C0M
- TLSH
  T13F96331B4268576CFD1E74A6F610A62E1263B304ADBFECCDC86F3ACE8A7F959041141D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  NEVERLOSE/NEVERLOSE.exe
- Size 14.6MB
- SHA256 79d86ff387f614c2f124e01c3a87c0c3a6762d6b18ce48aa0e06618a3b541acb
- MD5 0c302b89b202edf95e9708d9c73b37ed
- SHA1 fdf18bd08130247ad9fc1bf8f14d373e0994763a
- SHA512 c1608ae0134e213fae674f10ac2bc3fe6b3ea131d132bf696e6d8e77138808a4b8f905ba5840ff65b6d097a968e641a228b91622588640532975274b45e51277
- SSDEEP 98304:nhFvdLAEdU3j3Lgps187DYws/lPrJcpd2V5P0KOv2PZI:nhFdEEqbLcs187DHETJcpdxvau
- TLSH
  T1E6F62709625542ADC03AA2724953DF77E321FC44477896EB33EC2E1F3FF27A84A6A511
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Contacts third-party web service commonly abused for C2

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4