Overview

overview

10

Static

static

3

TestFKRT.exe

windows7-x64

7

TestFKRT.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TestFKRT.exe

  • Size

    375KB

  • Sample

    240611-nt3mtswdkp

  • MD5

    7167b97b30f2650bc2fe30ea6aea8c60

  • SHA1

    1df3d35a76b75545a092db90ad74a5732a52be00

  • SHA256

    c38f9d7b02cb20690aae34a7b85ca91c95be43813ca609694d79a13111357bf4

  • SHA512

    183fbe184aae509f5e7728316dc6e31e1505476dce42c17e433d0c3b1c6865bef55ff806ad359bd0dfb0e7d945d4ba11a7565067b88fec3f514ee3e3d4128b0c

  • SSDEEP

    6144:MOGkB/vhyOc10KgGwHqwOOELha+sm2D2+UhngNQK4t6DqeLUEEiRgc5uJV/qb:vhzc10KgGXFhazmdVg+K4t6DqbEBuJV

Score
10/10
netsupportrat

Malware Config

Targets

    • Target

      TestFKRT.exe

    • Size

      375KB

    • MD5

      7167b97b30f2650bc2fe30ea6aea8c60

    • SHA1

      1df3d35a76b75545a092db90ad74a5732a52be00

    • SHA256

      c38f9d7b02cb20690aae34a7b85ca91c95be43813ca609694d79a13111357bf4

    • SHA512

      183fbe184aae509f5e7728316dc6e31e1505476dce42c17e433d0c3b1c6865bef55ff806ad359bd0dfb0e7d945d4ba11a7565067b88fec3f514ee3e3d4128b0c

    • SSDEEP

      6144:MOGkB/vhyOc10KgGwHqwOOELha+sm2D2+UhngNQK4t6DqeLUEEiRgc5uJV/qb:vhzc10KgGXFhazmdVg+K4t6DqbEBuJV

    Score
    10/10
    netsupportrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks