Overview

overview

10

Static

static

1

AudioCapture.dll

windows7-x64

3

AudioCapture.dll

windows10-2004-x64

3

HTCTL32.dll

windows7-x64

3

HTCTL32.dll

windows10-2004-x64

3

PCICHEK.dll

windows7-x64

3

PCICHEK.dll

windows10-2004-x64

3

PCICL32.dll

windows7-x64

3

PCICL32.dll

windows10-2004-x64

3

TCCTL32.dll

windows7-x64

3

TCCTL32.dll

windows10-2004-x64

3

client32.exe

windows7-x64

10

client32.exe

windows10-2004-x64

10

msvcr100.dll

windows7-x64

3

msvcr100.dll

windows10-2004-x64

3

pcicapi.dll

windows7-x64

3

pcicapi.dll

windows10-2004-x64

3

remcmdstub.exe

windows7-x64

3

remcmdstub.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    q93Cwade.zip

  • Size

    2.1MB

  • Sample

    241101-xteqfasmdx

  • MD5

    150add4ebd11295142dede7722dd60ab

  • SHA1

    78ba5ea4568339f6959848d12feed49d5da065c1

  • SHA256

    18017a0f96e0da2be7e93c7c30527efd622d9a670b86d0adc098b5b28d100206

  • SHA512

    e0fd6352d0f5b9bbd1a177b063a98c04e307b27d1c06af3df3c2edd0b301e815dde2925cc3339647035737e03627338419843994dd958232d3076a0aa9c504da

  • SSDEEP

    49152:ijW0xxIYrp7cXY7hsfw/TcLNXGqVlQc/67IjDs6:iqGuSUHw4LNNlB/Oas6

Score
10/10
netsupportdiscoveryrat

Malware Config

Targets

    • Target

      AudioCapture.dll

    • Size

      91KB

    • MD5

      4182f37b9ba1fa315268c669b5335dde

    • SHA1

      2c13da0c10638a5200fed99dcdcf0dc77a599073

    • SHA256

      a74612ae5234d1a8f1263545400668097f9eb6a01dfb8037bc61ca9cae82c5b8

    • SHA512

      4f22ad5679a844f6ed248bf2594af94cf2ed1e5c6c5441f0fb4de766648c17d1641a6ce7c816751f0520a3ae336479c15f3f8b6ebe64a76c38bc28a02ff0f5dc

    • SSDEEP

      1536:wrOxDJs/Ksdl0R1dBmhFXxRpP9JNvbnPUGI:3yXlQmhhHp9J9bnPTI

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      HTCTL32.DLL

    • Size

      320KB

    • MD5

      2d3b207c8a48148296156e5725426c7f

    • SHA1

      ad464eb7cf5c19c8a443ab5b590440b32dbc618f

    • SHA256

      edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

    • SHA512

      55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

    • SSDEEP

      6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      PCICHEK.DLL

    • Size

      18KB

    • MD5

      a0b9388c5f18e27266a31f8c5765b263

    • SHA1

      906f7e94f841d464d4da144f7c858fa2160e36db

    • SHA256

      313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

    • SHA512

      6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

    • SSDEEP

      192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      PCICL32.DLL

    • Size

      3.3MB

    • MD5

      916c03d8fc0c1fd211c254737dff1055

    • SHA1

      948ee4fbae7ce9dc7a37ccaca75341876bbf5d70

    • SHA256

      250e8bbec081ae5e65b669da92652af6d4266db816c8705fbc9be84707914d99

    • SHA512

      ad18049763a0c289f80c0efa21fbe2a44d0d3f4b5f3686ed9be7562e5c9c68f932a8047377e3a5a8a2a6f09046bb12eadf8b6d3b99dfaa81650fa633ccee1050

    • SSDEEP

      49152:IPcnfKOu6iigooamJwfLlH41GarwYoxeOfR90J0TpHaJclST2503:IPcniOu6CvJwfLVzpxeO59/Sv

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      TCCTL32.DLL

    • Size

      448KB

    • MD5

      69f72ad2dad99ff0fbc7f2c671523014

    • SHA1

      8aaab0955014b89ca794a51dd527d3afe6f38a94

    • SHA256

      23f17cc168cc82b8ae16f3fc041d4465e1b12e66dcac1713f582f99303a740dd

    • SHA512

      ea18d92790f52405027666b7501cf908426b9b57fec4157a45d86387d50324e414644245269dc1a0567b27c6c4b7c4b323d692bf449add4797dfcd7101531349

    • SSDEEP

      12288:suqhtvbez3wj9AP8Ah0DAmlse99fow3/qkxf5iJg0nTUtnTvm:s3htk/eHoJktEKITUFTvm

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      client32.exe

    • Size

      118KB

    • MD5

      4f2d0f4a5ba798fa9e85379c7c4bd36e

    • SHA1

      e533f2318d232ef3e1b22bdd1d6b61c081c6d6eb

    • SHA256

      aaa12a1ad8c748fbfd4c8f2e5023ec3481b18cb088b28737fc7e665163cff41d

    • SHA512

      4c338e4f87f5ac9e9339e663739b021f06d8ee48f7a5981ccdf85029888964e3c416331c7ec791933a6b3d56ec44bb3719a38039f625a25b86ba0264e3d2d609

    • SSDEEP

      768:Wm8j0+RvW6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDJg:WbpvWiLniepfxP91/bQxEj

    Score
    10/10
    netsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport
    behavioral11behavioral12

    • Target

      msvcr100.dll

    • Size

      755KB

    • MD5

      0e37fbfa79d349d672456923ec5fbbe3

    • SHA1

      4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    • SHA256

      8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    • SHA512

      2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

    • SSDEEP

      12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      pcicapi.dll

    • Size

      32KB

    • MD5

      dcde2248d19c778a41aa165866dd52d0

    • SHA1

      7ec84be84fe23f0b0093b647538737e1f19ebb03

    • SHA256

      9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

    • SHA512

      c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

    • SSDEEP

      768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      remcmdstub.exe

    • Size

      58KB

    • MD5

      ba2a1815e16b357eeff23b8394457aa5

    • SHA1

      2492e2393cdaed5678ea0a573c50d06ec5f191f4

    • SHA256

      e14c3224215ea91587e96b995861e8966166dfc08ab4d409bd729770815b3b81

    • SHA512

      d505a1a17c44a96e74f94238b3623d7e6064b8c94007f2d94d6626eeee3ba75db92e569bc864c90096eabf61a0cd68ae690461b43b6e429b4deda1b44e18ba41

    • SSDEEP

      1536:Wf6nvXuNcAjJMBUHYBlXU1wT2JFqyuAQYPT:g6nPcjJ4U4I1jFqyuHuT

    Score
    3/10
    discovery
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks