netsupport

Sharing

Copy URL

Twitter E-mail

General

Target

security_install.iso
Size

37.8MB
Sample

220822-lbje5aggd2
MD5

b2d0219ba59caed06c6e7466de3489f9
SHA1

4508e1ddd758ed6ce0465ddbf317671da429b11e
SHA256

26a30811833fd93ecb266b4e2287e9b30cb99aff38e5109398462946fced4ab0
SHA512

ad75f3a26a0152511808eecd46618dfc228002be2d9aa20e189e1228fbb441249ad1446d15c23ead13f9fd267491ebba3c5879b64548f8be0404b9d11fc42473
SSDEEP

786432:dNNyNUt3peL6OwCv4cod3zEM6qLtFvW+1:djyN+eL6OwCwco3zbxFO+

Score

10^/10

netsupport rat

Malware Config

Targets

- Target
  
  DBUG.TXT
- Size
  
  155B
- MD5
  
  77b9171025ded8cd2e9d1ba349c77b5c
- SHA1
  
  4e364f871c99b3c647b33fe02c738f45434e398d
- SHA256
  
  7d1024920e09142e3d019503536f70ba7e7433cbf7220df99f12fa8fdc492968
- SHA512
  
  c1d50ed23b913f6d1ccb09607fcfb6269503c4b99cc4699a15c35db5e5ce98130163c1bf12e584954dd09ea4fc645f4c3f95239216c6dbde076f37214de794df
Score

1^/10
behavioral1 behavioral2
- Target
  
  WinSupportSn/AudioCapture.dll
- Size
  
  91KB
- MD5
  
  4182f37b9ba1fa315268c669b5335dde
- SHA1
  
  2c13da0c10638a5200fed99dcdcf0dc77a599073
- SHA256
  
  a74612ae5234d1a8f1263545400668097f9eb6a01dfb8037bc61ca9cae82c5b8
- SHA512
  
  4f22ad5679a844f6ed248bf2594af94cf2ed1e5c6c5441f0fb4de766648c17d1641a6ce7c816751f0520a3ae336479c15f3f8b6ebe64a76c38bc28a02ff0f5dc
- SSDEEP
  
  1536:wrOxDJs/Ksdl0R1dBmhFXxRpP9JNvbnPUGI:3yXlQmhhHp9J9bnPTI
Score

1^/10
behavioral3 behavioral4
- Target
  
  WinSupportSn/HTCTL32.DLL
- Size
  
  320KB
- MD5
  
  c94005d2dcd2a54e40510344e0bb9435
- SHA1
  
  55b4a1620c5d0113811242c20bd9870a1e31d542
- SHA256
  
  3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
- SHA512
  
  2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
- SSDEEP
  
  6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
Score

3^/10
behavioral5 behavioral6
- Target
  
  WinSupportSn/PCICHEK.DLL
- Size
  
  18KB
- MD5
  
  104b30fef04433a2d2fd1d5f99f179fe
- SHA1
  
  ecb08e224a2f2772d1e53675bedc4b2c50485a41
- SHA256
  
  956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
- SHA512
  
  5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
- SSDEEP
  
  192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
Score

1^/10
behavioral7 behavioral8
- Target
  
  WinSupportSn/PCICL32.DLL
- Size
  
  3.6MB
- MD5
  
  d3d39180e85700f72aaae25e40c125ff
- SHA1
  
  f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
- SHA256
  
  38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
- SHA512
  
  471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
- SSDEEP
  
  49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
Score

1^/10
behavioral9 behavioral10
- Target
  
  WinSupportSn/TCCTL32.DLL
- Size
  
  387KB
- MD5
  
  2c88d947a5794cf995d2f465f1cb9d10
- SHA1
  
  c0ff9ea43771d712fe1878dbb6b9d7a201759389
- SHA256
  
  2b92ea2a7d2be8d64c84ea71614d0007c12d6075756313d61ddc40e4c4dd910e
- SHA512
  
  e55679ff66ded375a422a35d0f92b3ac825674894ae210dbef3642e4fc232c73114077e84eae45c6e99a60ef4811f4a900b680c3bf69214959fa152a3dfbe542
- SSDEEP
  
  12288:HqArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/n6:ekuK2XOjksobom/n6
Score

1^/10
behavioral11 behavioral12
- Target
  
  WinSupportSn/client32.exe
- Size
  
  103KB
- MD5
  
  c60ac6a6e6e582ab0ecb1fdbd607705b
- SHA1
  
  ba9de479beb82fd97bbdfbc04ef22e08224724ba
- SHA256
  
  4d24b359176389301c14a92607b5c26b8490c41e7e3a2abbc87510d1376f4a87
- SHA512
  
  f91b964f8b9a0e7445fc260b8c75c831e7ce462701a64a39989304468c9c5ab5d1e8bfe376940484f824b399aef903bf51c679fcf45208426fff7e4e518482ca
- SSDEEP
  
  384:qqDV5+6j6Qa86Fkv2Wr120hZgoTSPT+TWit:qOVZl6FhWr80/goTwiTWit
Score

10^/10

netsupport rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
behavioral13 behavioral14
- Target
  
  WinSupportSn/msvcr100.dll
- Size
  
  755KB
- MD5
  
  0e37fbfa79d349d672456923ec5fbbe3
- SHA1
  
  4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA256
  
  8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- SHA512
  
  2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP
  
  12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
Score

3^/10
behavioral15 behavioral16
- Target
  
  WinSupportSn/pcicapi.dll
- Size
  
  32KB
- MD5
  
  34dfb87e4200d852d1fb45dc48f93cfc
- SHA1
  
  35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
- SHA256
  
  2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
- SHA512
  
  f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
- SSDEEP
  
  768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
Score

1^/10
behavioral17 behavioral18
- Target
  
  WinSupportSn/remcmdstub.exe
- Size
  
  62KB
- MD5
  
  6fca49b85aa38ee016e39e14b9f9d6d9
- SHA1
  
  b0d689c70e91d5600ccc2a4e533ff89bf4ca388b
- SHA256
  
  fedd609a16c717db9bea3072bed41e79b564c4bc97f959208bfa52fb3c9fa814
- SHA512
  
  f9c90029ff3dea84df853db63dace97d1c835a8cf7b6a6227a5b6db4abe25e9912dfed6967a88a128d11ab584663e099bf80c50dd879242432312961c0cfe622
- SSDEEP
  
  1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
Score

1^/10
behavioral19 behavioral20
- Target
  
  LOCALES/MSAMRNBD.DLL
- Size
  
  128KB
- MD5
  
  b8575c2ba2ac7255c9c1f2c809bdd730
- SHA1
  
  1b22df2dfcc5dc6143f1ec2c852f9ebd814ba5e0
- SHA256
  
  d303638cb83a7e2651e74e20db52691805b43fa222f2cc98e2b02cfb8536b8b2
- SHA512
  
  93c9955c63a0c9ef4296cea8efb58094332bf8ae1e3f25692ea16fd8893aec31dfafdd4ba70365d08a57a8c1fa121794fa4e2fe0b49c071f425cb5b6405d96e6
- SSDEEP
  
  3072:X+iAR5LJm1kvkLJv/c7XgxhSfJJ91LoJcAERJy00PyLvSFVBCo5w/f4EV5T9Xt2:XkRu1wQdcJ/7L0uW0T992
Score

1^/10
behavioral21 behavioral22
- Target
  
  LOCALES/MSAMRNBE.DLL
- Size
  
  201KB
- MD5
  
  312cc1a799f187bdd6872a44e94f51be
- SHA1
  
  d9717ea3770959859bfd775f02fee7fbe1cf9214
- SHA256
  
  f90cd8a5ab1200a8b9567fe183b91b2d0f5747d9895b4f1a2f2fdc24ee856d1f
- SHA512
  
  b6fa6dfafe1bc6171b8fe1e2e0afbbc673bed52a7f101cfae634ae5bba912b6d288d736e2ef35032e4de917c0d10cb844b7767f45cf6fe10e22d6f6eda48f8f3
- SSDEEP
  
  6144:Zratq0WGuUgMcPtHl6O5COtYzc7iJT9j:EtpWGgPTGc76j
Score

1^/10
behavioral23 behavioral24
- Target
  
  LOCALES/MSAUDDEC.DLL
- Size
  
  449KB
- MD5
  
  76d6aa7eac676315dfc00e17311a3cc5
- SHA1
  
  3cd60b77e354a46b9c0e103218edcd2fdb2567ae
- SHA256
  
  d245da122919f6b13f16d14ceda814518802864819df21961a5e10771dcae5fa
- SHA512
  
  896584c1518fdd25730157b319d2edb90dce5af70cac25f7ccc156df8bbc65120e6e5cf7d9a1c967c9907b59a97c0a017f8d6f6ff5e129334d9270725d1ed362
- SSDEEP
  
  12288:m8tEJTKnRGiBf4TuGVCNv1sE+T5fvmpHwVJon88tVksu5Q26t7XN:mnmnRJt4+T+T5fvwwVJonLu5Q26tzN
Score

1^/10
behavioral25 behavioral26
- Target
  
  LOCALES/MSAUDITE.DLL
- Size
  
  152KB
- MD5
  
  cfd83e99bf37959c401d08d813b78e52
- SHA1
  
  eaf8ba74a20af21be4e44a9c6cdd2fadeaaada0f
- SHA256
  
  706b84b5ce5de62c6cc0e55297330d1b44b512393f97bca263dd76022e27455a
- SHA512
  
  000fa01d8c8f89a97f640a6b9bb9434da87e4aef1d9f2a5107fa3908e8d33186da610105dd8ec270af83269d16ee025385eb6b2fd98cd1e2a4895978a0964785
- SSDEEP
  
  768:7i+fW3IPSXpNTN7i/eMR7A2cy9/SlGCUz8FN:7ywCjTY/eMRRX5SlAy
Score

1^/10
behavioral27 behavioral28
- Target
  
  LOCALES/PROTONVP.EXE
- Size
  
  26.9MB
- MD5
  
  e751f97a3d99007fd4f3bade78df78a1
- SHA1
  
  ec8be5c865e959b8675667a689851c2683e5c8d0
- SHA256
  
  b6db90130e99b34b6b28cd48c244b5c897baaa6f5cb200f83feb74d32614a3e3
- SHA512
  
  209ddb2fcd2ac2109ac517cf2608580286c7aa07ba876611caace0a057608112299468b7c1ff7b29ddbcfeabb7f037fed2cb64b622fe4fe925ef512d9725a5bd
- SSDEEP
  
  393216:sHx59nxhJiSeLlkWDwCv47V14sgoBSgTjdEyEMFwqLtZ/vzMkxaL7z+Nlp/:Ut3peL6OwCv4cod3zEM6qLtFvW+1/
Score

7^/10
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  
  LOCALES/TWAIN_32.DLL
- Size
  
  67KB
- MD5
  
  6bc0c27946a254e61a5124a38ad1ae62
- SHA1
  
  bad8ccfbed6110133e00d81f27bdb123f1854047
- SHA256
  
  0e7e161ea65bcfce69528a3147783e47102fb70f66adfbd7e9e0738799bf70a4
- SHA512
  
  1354b01d87707ea45e4de087fb03f9bb8d06f6dfc40f6d05bda7276654b9a1521de1df7570d02df4766e1730de88c002b2e70fa864fb5aec0f7789c1214f4ebf
- SSDEEP
  
  1536:X0x6ozZCpp3jggAoG/ahmD9p0b4fuUy/VZmx/e:X03ZCppHAN/7pr2Ug4J
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Enumerates connected drives

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32