Overview

overview

10

Static

static

10

target.ps1

windows7-x64

8

target.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    target.ps1

  • Size

    150B

  • Sample

    241028-rb8ynsymbn

  • MD5

    278c824586609106fac34d9cfb5713a9

  • SHA1

    6fde4f27b9ce91981b9c1aa33c3da5bab33d16da

  • SHA256

    9431c7d585f31d959ca97d5955a9ec2c83f51b379de0b89c3d74f64c1e288f46

  • SHA512

    3539709a495bb0632f285757011c431fb057ed894922f196a13a732cbb0dabdf752d2e6c084696921f5bb21d0aaa06bb8f8e351cfa7398d258ce9b051936c8f3

Score
10/10
netsupportdefense_evasiondiscoveryexecutionpersistencerat

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://traversecityspringbreak.com/o/o.png

Targets

    • Target

      target.ps1

    • Size

      150B

    • MD5

      278c824586609106fac34d9cfb5713a9

    • SHA1

      6fde4f27b9ce91981b9c1aa33c3da5bab33d16da

    • SHA256

      9431c7d585f31d959ca97d5955a9ec2c83f51b379de0b89c3d74f64c1e288f46

    • SHA512

      3539709a495bb0632f285757011c431fb057ed894922f196a13a732cbb0dabdf752d2e6c084696921f5bb21d0aaa06bb8f8e351cfa7398d258ce9b051936c8f3

    Score
    10/10
    defense_evasionexecutionpersistencenetsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks