Overview

overview

10

Static

static

3

Update_Acc...df.exe

windows7-x64

10

Update_Acc...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f086340341fe991a7df4e94f77e2c03.bin

  • Size

    1.9MB

  • Sample

    240407-bmtp5agh3y

  • MD5

    9ef1c92bda53a69f9ce0759244e11f55

  • SHA1

    32c0f1756420cf7fca0ead710d0a30ce11dde2f3

  • SHA256

    8a04f6e18e5ef8bae7791c1b3df25ee4c32598483aa5a1c45de54dbedc68f727

  • SHA512

    ac5e4230e61c7bbd795c1114c1a35990b0de096cc5d711381270841a06d9283372d3dde1437aca86a704f3232fe8881b50aab538aa9e035be7d652c7a9aa1a28

  • SSDEEP

    49152:QdtRhf03uGOu4rJ+GuCPRuCSgvk3gR5YmZ:QLwufrJjuHPgvk3gR5YmZ

Score
10/10
netsupportrat

Malware Config

Targets

    • Target

      Update_Accounting_billing_details_dtd_0026032024_pdf.exe

    • Size

      2.3MB

    • MD5

      6caefeb698c894cfa2a753e5f9ee8837

    • SHA1

      f6ebb2eb5e42bb1a3eac7027b0ef0ee919d65d06

    • SHA256

      ce15d5dc596387515a6efad0fffa352d1fa10365b223d07cb50019c4c8d23652

    • SHA512

      bf0e46d319132fc913de8a1039c0dc82716d1df1914fda36c25eea574a572a14d872f23458159f4a65e47cdf915f83e96af66f22d7891606a6febc95a6325c84

    • SSDEEP

      49152:6Bux81yXk8fQLTe3RJrwfRzrqLb6fCanBzMjPuXAONSJQ1:yuwy0uQLK3RJr5LbCjYjPqAjJI

    Score
    10/10
    netsupportrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks