Overview

overview

10

Static

static

3

Update_Acc...df.exe

windows7-x64

10

Update_Acc...df.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4f086340341fe991a7df4e94f77e2c03.bin
  • Size 1.9MB
  • Sample240407-bmtp5agh3y
  • SHA256 8a04f6e18e5ef8bae7791c1b3df25ee4c32598483aa5a1c45de54dbedc68f727
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
netsupportrat

Malware Config

Targets

    • Target
      Update_Accounting_billing_details_dtd_0026032024_pdf.exe
    • Size 2.3MB
    • SHA256 ce15d5dc596387515a6efad0fffa352d1fa10365b223d07cb50019c4c8d23652
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    netsupportrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks