General

  • Target

    188f24d52a3f17cf472f0b7860612c58.bin

  • Size

    3.3MB

  • Sample

    240818-bdlm6axajb

  • MD5

    ebb268d617de7d0e58c6736f11fc1b32

  • SHA1

    f63a4fe3dc81a1760e3d72ce0cb034bd4472ca12

  • SHA256

    52404a0302dcc2eb1ce8204bf5f75738709011fed624c731fd8eae340f215c1a

  • SHA512

    c95c3db031631baf14898474cdc5aab6a0b7b082e58df9334b100b1e312ab32f710d0c0e0892be38947dcc5f027ef66887cb98bd2e38d7944813c05536487e15

  • SSDEEP

    49152:+xiMR/imbb1tq3JTBDB7Uu1Lsrfsl8rKagjojIY4xXeIQQxm4LvAzNvOXBnjw+kx:+gMRnfqXdUiq0lYNsU1oXeEnvgoJE+kx

Malware Config

Targets

    • Target

      98cac6ef1484e379d2496f9a28b8c5077abab866e3977a6dfdd538b7817b65b7.exe

    • Size

      3.7MB

    • MD5

      188f24d52a3f17cf472f0b7860612c58

    • SHA1

      0fec989f098085c68be25fc48d366808aaac610a

    • SHA256

      98cac6ef1484e379d2496f9a28b8c5077abab866e3977a6dfdd538b7817b65b7

    • SHA512

      bd359f6061810c361d61e023b60ee4c9143216c40bd89ca8c38a02f8a19ea325998dc7f0e7cfed4c948b80215b973cb54bb9209d067f09233a5084c79ced8356

    • SSDEEP

      98304:cVOXXUzpyl/iMcLtN4LS8dHxbuBTYoVXKhyRH0BwMX:0Vzpl4L7dHjo4hyRH7+

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks