netsupport | 98cac6ef1484e379d2496f9a28b8c5077abab866e3977a6dfdd538b7817b65b7 | Triage

Sharing

General

Target

98cac6ef1484e379d2496f9a28b8c5077abab866e3977a6dfdd538b7817b65b7.exe
Size

3.7MB
Sample

240817-bwqd3asfpl
MD5

188f24d52a3f17cf472f0b7860612c58
SHA1

0fec989f098085c68be25fc48d366808aaac610a
SHA256

98cac6ef1484e379d2496f9a28b8c5077abab866e3977a6dfdd538b7817b65b7
SHA512

bd359f6061810c361d61e023b60ee4c9143216c40bd89ca8c38a02f8a19ea325998dc7f0e7cfed4c948b80215b973cb54bb9209d067f09233a5084c79ced8356
SSDEEP

98304:cVOXXUzpyl/iMcLtN4LS8dHxbuBTYoVXKhyRH0BwMX:0Vzpl4L7dHjo4hyRH7+

Score

10^/10

netsupport discovery rat

Malware Config

Targets

- Target
  
  98cac6ef1484e379d2496f9a28b8c5077abab866e3977a6dfdd538b7817b65b7.exe
- Size
  
  3.7MB
- MD5
  
  188f24d52a3f17cf472f0b7860612c58
- SHA1
  
  0fec989f098085c68be25fc48d366808aaac610a
- SHA256
  
  98cac6ef1484e379d2496f9a28b8c5077abab866e3977a6dfdd538b7817b65b7
- SHA512
  
  bd359f6061810c361d61e023b60ee4c9143216c40bd89ca8c38a02f8a19ea325998dc7f0e7cfed4c948b80215b973cb54bb9209d067f09233a5084c79ced8356
- SSDEEP
  
  98304:cVOXXUzpyl/iMcLtN4LS8dHxbuBTYoVXKhyRH0BwMX:0Vzpl4L7dHjo4hyRH7+
Score

10^/10

discovery netsupport rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

netsupportdiscoveryrat