Overview

overview

10

Static

static

10

o.ps1

windows7-x64

6

o.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    o.png

  • Size

    1KB

  • Sample

    241021-qrnr1avgra

  • MD5

    1cd885f4c6f1c7c1dc41fa8947ecba9c

  • SHA1

    69888380e344b7e288fc10717f5bc7c7c4fdf805

  • SHA256

    eca9ad453dc403d8557c7f31e19504790527ef09b33d0678af947201522b56e4

  • SHA512

    4131654bb4517424e807d8d00cb6fcdc9f96613067dd8a513ae68a8c6258d978ba36c4940204e3f5bedbda246e44c25caf0fdd9881e897b6b8a3e01cedcba894

Score
10/10
netsupportdefense_evasiondiscoveryexecutionpersistencerat

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://traversecityspringbreak.com/o/1.png
exe.dropper

http://traversecityspringbreak.com/o/2.png
exe.dropper

http://traversecityspringbreak.com/o/3.png
exe.dropper

http://traversecityspringbreak.com/o/4.png
exe.dropper

http://traversecityspringbreak.com/o/5.png
exe.dropper

http://traversecityspringbreak.com/o/6.png
exe.dropper

http://traversecityspringbreak.com/o/7.png
exe.dropper

http://traversecityspringbreak.com/o/8.png
exe.dropper

http://traversecityspringbreak.com/o/9.png
exe.dropper

http://traversecityspringbreak.com/o/10.png
exe.dropper

http://traversecityspringbreak.com/o/11.png
exe.dropper

http://traversecityspringbreak.com/o/12.png

Targets

    • Target

      o.png

    • Size

      1KB

    • MD5

      1cd885f4c6f1c7c1dc41fa8947ecba9c

    • SHA1

      69888380e344b7e288fc10717f5bc7c7c4fdf805

    • SHA256

      eca9ad453dc403d8557c7f31e19504790527ef09b33d0678af947201522b56e4

    • SHA512

      4131654bb4517424e807d8d00cb6fcdc9f96613067dd8a513ae68a8c6258d978ba36c4940204e3f5bedbda246e44c25caf0fdd9881e897b6b8a3e01cedcba894

    Score
    10/10
    defense_evasionexecutionpersistencenetsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks