Overview

overview

10

Static

static

1

WinIconMak...up.msi

windows7-x64

10

WinIconMak...up.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    512ac6847421bbfc027322074ca009a1.bin

  • Size

    35.1MB

  • Sample

    240203-bqsl8sfhhm

  • MD5

    5360ef119c00e99917a051ab81974215

  • SHA1

    c306f64de1dbcf70e17cd0282bf83d975f9c4805

  • SHA256

    3bee17c7d5dd6c2bb4a8e691679d6a5aac5f5b4400c4f68d9c1a37d35a39670a

  • SHA512

    d772a36f8cdef3f043d109436553b3b063230c8298c19481a864e14df8224c711859edbec6a6e62f66ca1cdde61da85da76c44225751fab66159c2536fc56cfb

  • SSDEEP

    786432:/qTTDc+irfanegdnmnSw6WOg8CINjTXjGyhl2zzyNhQ0XxC5:/q8IdnGMkINvX62MzzKQKo

Score
10/10
netsupportevasionpersistencerat

Malware Config

Targets

    • Target

      WinIconMakerFreeSetup.msi

    • Size

      35.2MB

    • MD5

      1414b254f44bba8e17b01983dc22adde

    • SHA1

      a12059b028647968a03d9483815dc5c13bb4b841

    • SHA256

      474fbd180a26139e8013595adedc0ce2bb434677ae667093f86d4a59b11c7045

    • SHA512

      1ea087707ab1f63af26950714d11376bd284984dca4069ab5adf5e35b766b82c6f65447d770ada792a4d1e334e6f5952c0f917e227f3b318986bea819f33e899

    • SSDEEP

      786432:XotrfQO1b8zWttlyhgMglwI4nFbZ2s7i4iOXmditJf0nnPl1x:4trPozWtPyhXJdi4i7EtW91

    Score
    10/10
    netsupportevasionpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Modifies Windows Firewall

      evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks