netsupport

Resubmissions

29/06/2024, 23:51

240629-3v89bstaqn1

29/06/2024, 23:50

29/06/2024, 23:44

29/06/2024, 23:38

26/09/2023, 13:19

Sharing

Copy URL Twitter E-mail

General

Target
p.zip
Size 3.0MB
Sample240629-3vnbvszbrf
SHA256 e47f973b2e997059589fdcb011e2f6095a1251ee54daffef56e060046932f79b
MD5 d56a61dc58e673c59d5a8e85bcc82a0a
SHA1 9706ad047b41d56827e9afb0f893f4c993c67b8e
SHA512 e4b965d81ef8d4f00319953aaceca432060ae8c2deed34cab20709b1bb17cfca47a8d08e553075216467f343acc7995d86aba74f580c09b479e53718c262dfd3
SSDEEP 98304:t14FXamhRFY89YYc9jh23redpmQRiXuYESBZFR02jZc:r4HxYoY59V0redpmQRiNfZc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

netsupport rat

Malware Config

Targets

- Target
  HTCTL32.DLL
- Size 320KB
- SHA256 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
- MD5 c94005d2dcd2a54e40510344e0bb9435
- SHA1 55b4a1620c5d0113811242c20bd9870a1e31d542
- SHA512 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
- SSDEEP 6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral1 behavioral2
- Target
  HTML_Obj_list.txt
- Size 2KB
- SHA256 c72222d06efcde95006dd8e5103ebc74c9a7d0d0d1aacdf62a7e9aaa4a13d1c5
- MD5 71274b421d3cd7646b01f3b9d470d04c
- SHA1 47d5fd4647a5948f1a00871f6ed0dc602230b642
- SHA512 ea237affda8714265d40edfe04b2f1b6ebba3eb0ced12165b831be12a1a89b0e9b87c43ff723da12323d31d497345ddf570c7a606cab8227447495800bbd486b
- MD5 SHA1 SHA512
Score

1^/10
behavioral3 behavioral4
- Target
  PCICL32.DLL
- Size 3.6MB
- SHA256 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
- MD5 d3d39180e85700f72aaae25e40c125ff
- SHA1 f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
- SHA512 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
- SSDEEP 49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  TCCTL32.DLL
- Size 387KB
- SHA256 6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea
- MD5 eab603d12705752e3d268d86dff74ed4
- SHA1 01873977c871d3346d795cf7e3888685de9f0b16
- SHA512 77de0d9c93ccba967db70b280a85a770b3d8bea3b707b1abb037b2826b48898fec87924e1a6cce218c43478e5209e9eb9781051b4c3b450bea3cd27dbd32c7f3
- SSDEEP 12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  client32.exe
- Size 99KB
- SHA256 213af995d4142854b81af3cf73dee7ffe9d8ad6e84fda6386029101dbf3df897
- MD5 f70b67c2b3204b7ddd8b755799cccff0
- SHA1 a42e55e328d62d11e687c167bb7049d46f0f9b26
- SHA512 54fcba8a063bfbaae4c3a39624bf3407db6af5699ab8686f936ab03c5864df7a44d089066fa2d4aedf5ad50d6b04624966a5111bf57bec1dda74a571f1dd7c63
- SSDEEP 384:qUjV5+6j6Qa86Fkv2Wr120hZIq6nYPL7NheMxnB1:qgVZl6FhWr80/h6EN/
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

netsupport rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
behavioral10 behavioral9
- Target
  msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  pcicapi.dll
- Size 32KB
- SHA256 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
- MD5 34dfb87e4200d852d1fb45dc48f93cfc
- SHA1 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
- SHA512 f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
- SSDEEP 768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  putty.exe
- Size 1.6MB
- SHA256 fc6f9dbdf4b9f8dd1f5f3a74cb6e55119d3fe2c9db52436e10ba07842e6c3d7c
- MD5 f838fdafd0881cf1e6040a07d78e840d
- SHA1 2a35456b2f67bd12905378beb6eaf373f6a0d0d1
- SHA512 5c0389eb79e5c2638c0d770cde1a5c56a237aa596503966d4f226a99f94531af501f8bf4efa00722e12998f73271e50d8c187f8e984125affe40b1ab231503b4
- SSDEEP 49152:TDXOPFJK9bbYF8paMB8QMy3bHwPXNg/7UyW+ekBeZmn:T0WhreNg/X
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  remcmdstub.exe
- Size 62KB
- SHA256 fedd609a16c717db9bea3072bed41e79b564c4bc97f959208bfa52fb3c9fa814
- MD5 6fca49b85aa38ee016e39e14b9f9d6d9
- SHA1 b0d689c70e91d5600ccc2a4e533ff89bf4ca388b
- SHA512 f9c90029ff3dea84df853db63dace97d1c835a8cf7b6a6227a5b6db4abe25e9912dfed6967a88a128d11ab584663e099bf80c50dd879242432312961c0cfe622
- SSDEEP 1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18