netsupport | 60dbaed2358a02ed2102cc2158c05fce9bba87674d68f1114198423bd8460a93 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1.bat
Size

9KB
Sample

230713-2k8dlsbd98
MD5

4b2794840b114be5011da81ad4c462d8
SHA1

66cf9461efa6fb1e55af037515121d2a856670ac
SHA256

60dbaed2358a02ed2102cc2158c05fce9bba87674d68f1114198423bd8460a93
SHA512

28d60ca188d99af1e6338d97cbcde497f5325c1a7da132b7d8f9c29a630d93570b488db40bc3ded89fa96c04153298b6a15128f641fcb1134cfa8d933d9e8b2c
SSDEEP

192:JhSy/Ogy0+OPN3b9h5gIZpiuhHA9waK+FJYY9gUeYzUEo1UfUu:JhSy/Ogy0+OPN3b1gBuRAzKEJD6G

Score

10^/10

netsupport persistence rat

Malware Config

Targets

- Target
  
  1.bat
- Size
  
  9KB
- MD5
  
  4b2794840b114be5011da81ad4c462d8
- SHA1
  
  66cf9461efa6fb1e55af037515121d2a856670ac
- SHA256
  
  60dbaed2358a02ed2102cc2158c05fce9bba87674d68f1114198423bd8460a93
- SHA512
  
  28d60ca188d99af1e6338d97cbcde497f5325c1a7da132b7d8f9c29a630d93570b488db40bc3ded89fa96c04153298b6a15128f641fcb1134cfa8d933d9e8b2c
- SSDEEP
  
  192:JhSy/Ogy0+OPN3b9h5gIZpiuhHA9waK+FJYY9gUeYzUEo1UfUu:JhSy/Ogy0+OPN3b1gBuRAzKEJD6G
Score

10^/10

netsupport persistence rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

netsupportpersistencerat