Overview

overview

10

Static

static

3

44.exe

windows7-x64

10

44.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44.exe

  • Size

    2.1MB

  • Sample

    240506-n4yrmaeb55

  • MD5

    e2c83f35496dbfd0845642ac76224637

  • SHA1

    95ad744cced02c494dfd1ca54933a733e06c0237

  • SHA256

    c45a28d77289e247d95395e4cbcb1d3f7f7133cc6237fc40495064889bb230ff

  • SHA512

    0f3428684aea35e4fcc4d2402168b7a8ee93afaa3d2e25157bfdf7cde4401e599490fe73a3cddc3cc3d32c3b14cb9275e193af4f04d89a86ce04f45b9f36a411

  • SSDEEP

    49152:KB6jq6Rm0EkHbG+Vw6NbHHBp7k5hhelN6YawnqXKwgVRM:s6ufCwYt5ShAiYawJwN

Score
10/10
netsupportrat

Malware Config

Targets

    • Target

      44.exe

    • Size

      2.1MB

    • MD5

      e2c83f35496dbfd0845642ac76224637

    • SHA1

      95ad744cced02c494dfd1ca54933a733e06c0237

    • SHA256

      c45a28d77289e247d95395e4cbcb1d3f7f7133cc6237fc40495064889bb230ff

    • SHA512

      0f3428684aea35e4fcc4d2402168b7a8ee93afaa3d2e25157bfdf7cde4401e599490fe73a3cddc3cc3d32c3b14cb9275e193af4f04d89a86ce04f45b9f36a411

    • SSDEEP

      49152:KB6jq6Rm0EkHbG+Vw6NbHHBp7k5hhelN6YawnqXKwgVRM:s6ufCwYt5ShAiYawJwN

    Score
    10/10
    netsupportrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks