netsupport

Sharing

Copy URL

Twitter E-mail

General

Target

0acb4b0b9141522ba0daf85ea29ea2c2808426ef241a5bac4c9141116ebf63ba.zip
Size

3.0MB
Sample

240408-bekr9aca4z
MD5

b08b5c82306385f052353c7deff767db
SHA1

ddbafa71ec2063ba62f35184afb3462eeb36140d
SHA256

0acb4b0b9141522ba0daf85ea29ea2c2808426ef241a5bac4c9141116ebf63ba
SHA512

2d590429d61e2c7391332f2d4eb015e6dad9fcaa58ca5c3c5450cc3cfcaf0e496e77ce2ca2acc799f415c03aba5c972b647e1750e7652c364f414000704fdf8f
SSDEEP

98304:Z89i7JDmWKwOA4qJtVqFLCr/L6BP+UomU:Z8oDmWKqtcLCrGl9U

Score

10^/10

netsupport rat

Malware Config

Targets

- Target
  
  ForceCPU.exe
- Size
  
  19KB
- MD5
  
  b982a103b0d4e0db856026a163124bf3
- SHA1
  
  40772be00068bbd394ff0fccd551151a822f3e70
- SHA256
  
  2d209c2b823e350c1f1661f87a3a013804302477afe56877f94adbafe7a2e06d
- SHA512
  
  214ecdf348e2093e91a489c0541f05eb3356e2531c1840a99d9f727caf1130f5041ccbc6356a7bc31fb4dece927d3fee2fa9e4689d2badbe680fd40104a9d327
- SSDEEP
  
  192:fHtIemmfltxD5WLtWwiyT5hNGnYe+PjPxucwwyibSucwwQJk35H0JOqxEV1a//bG:xD5WLZ5qnYPLxoDfoDg+JNY1cAhhv
Score

9^/10
- Detects Windows executables referencing non-Windows User-Agents
behavioral1 behavioral2
- Target
  
  HTCTL32.DLL
- Size
  
  320KB
- MD5
  
  c94005d2dcd2a54e40510344e0bb9435
- SHA1
  
  55b4a1620c5d0113811242c20bd9870a1e31d542
- SHA256
  
  3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
- SHA512
  
  2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
- SSDEEP
  
  6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
Score

3^/10
behavioral3 behavioral4
- Target
  
  PCICHEK.DLL
- Size
  
  18KB
- MD5
  
  104b30fef04433a2d2fd1d5f99f179fe
- SHA1
  
  ecb08e224a2f2772d1e53675bedc4b2c50485a41
- SHA256
  
  956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
- SHA512
  
  5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
- SSDEEP
  
  192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
Score

1^/10
behavioral5 behavioral6
- Target
  
  PCICL32.DLL
- Size
  
  3.6MB
- MD5
  
  d3d39180e85700f72aaae25e40c125ff
- SHA1
  
  f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
- SHA256
  
  38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
- SHA512
  
  471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
- SSDEEP
  
  49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
Score

1^/10
behavioral7 behavioral8
- Target
  
  QWhale.Common.dll
- Size
  
  192KB
- MD5
  
  ac80e3ca5ec3ed77ef7f1a5648fd605a
- SHA1
  
  593077c0d921df0819d48b627d4a140967a6b9e0
- SHA256
  
  93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5
- SHA512
  
  3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159
- SSDEEP
  
  1536:jnPlSpsvrGlP3wYeBKpqmSNbgM9ZtZLZQErK3PmIDXRtFhCj6ocpjyc44lc:rlSpsnQCg4ZtZmECfRtF0cpjy94lc
Score

1^/10
behavioral10 behavioral9
- Target
  
  QWhale.Editor.dll
- Size
  
  816KB
- MD5
  
  eaa268802c633f27fcfc90fd0f986e10
- SHA1
  
  21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f
- SHA256
  
  fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54
- SHA512
  
  c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47
- SSDEEP
  
  12288:vC84TFHhCRR87er17m62l/YpMVuRWGoN0ty6B:vC9T+R87er325wMVuRaGtPB
Score

1^/10
behavioral11 behavioral12
- Target
  
  QWhale.Syntax.dll
- Size
  
  228KB
- MD5
  
  3be64186e6e8ad19dc3559ee3c307070
- SHA1
  
  2f9e70e04189f6c736a3b9d0642f46208c60380a
- SHA256
  
  79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c
- SHA512
  
  7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78
- SSDEEP
  
  3072:Ns/3b/8FpHf3kBFcCsbfqai2/8Fjitdmus95jMRrgk+vWZYz39dHiB796k9gR5+r:NQLa/kBFcCsbfRgzM07XGk+V
Score

1^/10
behavioral13 behavioral14
- Target
  
  SampleRules.js
- Size
  
  22KB
- MD5
  
  20d1011d9574262b1320069c5225cc0a
- SHA1
  
  40589d89dcd94e7ec7aa97fad9b1ed646f20908d
- SHA256
  
  6bf057366b437b085dd5fd1ef2dfbad2769b76ef690ec774047904cd00da7307
- SHA512
  
  225e6a1e7c9d201765b633d2f132d86bf18d2e9738a00c1ecbcda80540edcd9d3efa59110a6415fe4d86966b9dbb050d0f863cd188381d054c301c545162f88e
- SSDEEP
  
  192:Y8hsvsRImy1MTb0LB1GeagkQqzzzgWGZIVW0Gdcen9CpNlPdhr3f8nYny7+zjW66:Yi0gg2zWia9SVnyqOZ
Score

1^/10
behavioral15 behavioral16
- Target
  
  SimpleFilter.dll
- Size
  
  147KB
- MD5
  
  90cdc635a1f1f8e6e1ee68918e0fb71a
- SHA1
  
  65699920fc6fc9488c1eb8acaf5022eaeafb6815
- SHA256
  
  afee7df6255757b3251721fca42e844753a617e0aa1ed43734e32e2fdae2c0af
- SHA512
  
  720635e0e24ca06b3c400f6da201f08d174e5bef230037eeae023ca87f608b1c353ca58de1a5c99a5f3057b039704ed5e68a9e5448183527653afcaedcfc58ab
- SSDEEP
  
  3072:e6NX70tFXM29SwIEV21p/r+Q7NNi+NQmDdj7RMttBaOrMzz27CDHqyoqKIh4bqG8:e6NXwM29SwIEV21p/r+Q7NNi+NQmDdjj
Score

1^/10
behavioral17 behavioral18
- Target
  
  TCCTL32.DLL
- Size
  
  387KB
- MD5
  
  eab603d12705752e3d268d86dff74ed4
- SHA1
  
  01873977c871d3346d795cf7e3888685de9f0b16
- SHA256
  
  6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea
- SHA512
  
  77de0d9c93ccba967db70b280a85a770b3d8bea3b707b1abb037b2826b48898fec87924e1a6cce218c43478e5209e9eb9781051b4c3b450bea3cd27dbd32c7f3
- SSDEEP
  
  12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
Score

1^/10
behavioral19 behavioral20
- Target
  
  Timeline.dll
- Size
  
  51KB
- MD5
  
  ec476c3ee3f7d463fc8b71a8da42e103
- SHA1
  
  a32e85e618a4451feefed350f7fdb88dc662833d
- SHA256
  
  25e20d696fa2d40cab80d6e45e998f63ef17564b4bacd978d98dbf4492be93ee
- SHA512
  
  ec3c77cb84667aea1330dbeb9e5756a37f55570e4edc1bdde9c873e9218cfed6da2c0df57f4f3f9c2864cb664d1eb55700c95a1555d4bc5d485f0fc028c02c3b
- SSDEEP
  
  768:BE8uqoL19VqLPLyYhH9L52OBRz6e4NPTijqhRR2fTMR2fT8BN266bC:YVqLPLyYhFcGzyijLx26O
Score

1^/10
behavioral21 behavioral22
- Target
  
  api-ms-win-crt-runtime-l1-1-0.dll
- Size
  
  22KB
- MD5
  
  ae3fa6bf777b0429b825fb6b028f8a48
- SHA1
  
  b53dbfdb7c8deaa9a05381f5ac2e596830039838
- SHA256
  
  66b86ed0867fe22e80b9b737f3ee428be71f5e98d36f774abbf92e3aaca71bfb
- SHA512
  
  1339e7ce01916573e7fdd71e331eeee5e27b1ddd968cadfa6cbc73d58070b9c9f8d9515384af004e5e015bd743c7a629eb0c62a6c0fa420d75b069096c5d1ece
- SSDEEP
  
  384:5b7hrKIW2hW6SUA0GftpBjoQt1TlI663UMp:5bNrKcziZzW66kMp
Score

1^/10
behavioral23
- Target
  
  api-ms-win-crt-stdio-l1-1-0.dll
- Size
  
  24KB
- MD5
  
  32d7b95b1bce23db9fbd0578053ba87f
- SHA1
  
  7e14a34ac667a087f66d576c65cd6fe6c1dfdd34
- SHA256
  
  104a76b41cbd9a945dba43a6ffa8c6de99db2105d4ce93a717729a9bd020f728
- SHA512
  
  7dad74a0e3820a8237bab48f4962fe43e5b60b00f003a5de563b4cf61ee206353c9689a639566dc009f41585b54b915ff04f014230f0f38416020e08c8a44cb4
- SSDEEP
  
  384:vUFVhjW2hWcgbCA0GftpBjH95mnlvQyURz8te:szC8iEvU2Y
Score

1^/10
behavioral24
- Target
  
  api-ms-win-crt-string-l1-1-0.dll
- Size
  
  24KB
- MD5
  
  5e72659b38a2977984bbc23ed274f007
- SHA1
  
  ea622d608cc942bdb0fad118c8060b60b2e985c9
- SHA256
  
  44a4db6080f6bdae6151f60ae5dc420faa3be50902e88f8f14ad457dec3fe4ea
- SHA512
  
  ed3cb656a5f5aee2cc04dd1f25b1390d52f3e85f0c7742ed0d473a117d2ac49e225a0cb324c31747d221617abcd6a9200c16dd840284bb29155726a3aa749bb1
- SSDEEP
  
  768:J6S5yguNvZ5VQgx3SbwA71IkF+w8iB66kP:Jl5yguNvZ5VQgx3SbwA71Itnb6kP
Score

1^/10
behavioral25
- Target
  
  api-ms-win-crt-time-l1-1-0.dll
- Size
  
  20KB
- MD5
  
  1fa7c2b81cdfd7ace42a2a9a0781c946
- SHA1
  
  f5b7117d18a7335228829447e3eccc7b806ef478
- SHA256
  
  cafdb772a1d7acf0807478fdba1e00fd101fc29c136547b37131f80d21dacffd
- SHA512
  
  339cdaf8de445cf05bc201400d65bb9037ea7a3782ba76864842adb6fbe5445d06863227dd774ab50e6f582b75886b302d5dd152aff1825cf90e4f252398ace0
- SSDEEP
  
  384:UzW2hWEgbCA0GftpBjJ6EKz3lvQyURz8X:y28i36bdvU2X
Score

1^/10
behavioral26
- Target
  
  audio/SampleRules.js
- Size
  
  22KB
- MD5
  
  524d2bade9189baf1556a19a646cf4bf
- SHA1
  
  66c1eff782d71d0a5cc8e370958137a9acd852e4
- SHA256
  
  3d4de2f5b6be253ffe40b04e90b6fe80eb1025f97975b820683e679c55f5b3c8
- SHA512
  
  36f1a2b9728e89b640fe5a5ee7cde1cdaacb6ca06149bbbe6fabec3d413dbef188f540568d68319df61e9c0d789e77489fe9893f8f4459f6b03cfef4a5b42095
- SSDEEP
  
  192:M8hsvsRImy1MTb0LB1GeagkQqzzzgWGZIVW0Gdcen9CpNlPdhr3f8nYny7+zjW66:Mi0gg2zWia9SVnyqOZ
Score

1^/10
behavioral27 behavioral28
- Target
  
  client33.exe
- Size
  
  101KB
- MD5
  
  c4f1b50e3111d29774f7525039ff7086
- SHA1
  
  57539c95cba0986ec8df0fcdea433e7c71b724c6
- SHA256
  
  18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
- SHA512
  
  005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
- SSDEEP
  
  768:q78j0+RH6e6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDU:qwpHLiLniepfxP91/bQxnu
Score

10^/10

netsupport rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
behavioral29 behavioral30
- Target
  
  libssl-3-x64.dll
- Size
  
  547KB
- MD5
  
  4ad9afd9ff710d89aa7530241771f9d9
- SHA1
  
  b0f233fde9ebc6438c66051fd13e89b9d457894a
- SHA256
  
  956a4925b8c2a62c7f639e855b1672a162610138f670f1d7ba6ab71ad3d94541
- SHA512
  
  28a167cbf7acca2bf36f7c50bc0302fd040812df678d1d36d1fcadbbfadb279444849aad0228c864d6866b00e36c09c2ff9a6a9d867c25b6000384b421a2f8f5
- SSDEEP
  
  6144:w5/NMS+7xbMkZThK/uhetwSzJupTJc2pqrbccv+5NDmqhIA3vCePl01sQi7PUYgh:wFNEQYKxtwAJeTJc2pmUD/v01sQigLW
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Detects Windows executables referencing non-Windows User-Agents

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32