Overview

overview

10

Static

static

10

bad.ps1

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bad.ps1

  • Size

    110B

  • Sample

    241021-tt83hayfje

  • MD5

    23459f07fe98c203526160a5b19ee84a

  • SHA1

    b865f279d511965afb81d100d771557b02c5539f

  • SHA256

    e0d913450fcaf59df1b73c7855bb838ff86ddc84045ca69c72ebc7a8c8a53b8f

  • SHA512

    e3b4e3715eed7db197ba032f5b40b1f9476b8201cbfc39bfe60d8211cd921092c854b64e0921f28150f5dee212a688eb03630425b21b0645480594c6e8ac81a3

Score
10/10
netsupportdefense_evasiondiscoveryexecutionpersistencerat

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://traversecityspringbreak.com/o/o.png

Targets

    • Target

      bad.ps1

    • Size

      110B

    • MD5

      23459f07fe98c203526160a5b19ee84a

    • SHA1

      b865f279d511965afb81d100d771557b02c5539f

    • SHA256

      e0d913450fcaf59df1b73c7855bb838ff86ddc84045ca69c72ebc7a8c8a53b8f

    • SHA512

      e3b4e3715eed7db197ba032f5b40b1f9476b8201cbfc39bfe60d8211cd921092c854b64e0921f28150f5dee212a688eb03630425b21b0645480594c6e8ac81a3

    Score
    10/10
    netsupportdefense_evasiondiscoveryexecutionpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks