General
-
Target
edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.zip
-
Size
15.1MB
-
Sample
240930-yele4ssbln
-
MD5
5e8596f1579a61512a8a88910da18854
-
SHA1
56e5419c8075f174a7d9fced2a8d69bea57a9967
-
SHA256
cfd27b3d61ad0cfcb0c5e31bb47144114b5ea37a7189a31bbf0c9ffa94e6f581
-
SHA512
ffaa82762a5d62c0b9e6808990274d5b341b6dae2aecb364502a691c1b36cc79845cf504b77cdde8f5d0e1c05d4d9c22ae6970a78d4791a5254f931fec803800
-
SSDEEP
393216:VgZjSS658UQkC/rzh40lQjhb0EVcBcxsbCzVCRic55aSb:VyjSS6O60ONHxs4jm
Malware Config
Targets
-
-
Target
edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4
-
Size
15.8MB
-
MD5
d3b4eacce35fb5b50b0f45f35119508c
-
SHA1
18ae2430f7ea7ae5e92e95ca251711a59738f31f
-
SHA256
edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4
-
SHA512
877829fc113b126094a96170a860cfbd2e54b7b1a4fecf7d21f1722922ae0183ffc7bf154b7fc6afdc6d3dc2cf4e619c72fdbb16c0444b52486042e6f1781235
-
SSDEEP
393216:j3JQVz1M/0XRlPzAuIhlQd5A1eT67vXUFjyO/Nk:gC0Pbxc/eTAUlymC
Score10/10-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-