Overview

overview

10

Static

static

1

AudioCapture.dll

windows7-x64

3

AudioCapture.dll

windows10-2004-x64

3

HTCTL32.dll

windows7-x64

3

HTCTL32.dll

windows10-2004-x64

3

PCICHEK.dll

windows7-x64

3

PCICHEK.dll

windows10-2004-x64

3

PCICL32.dll

windows7-x64

3

PCICL32.dll

windows10-2004-x64

3

TCCTL32.dll

windows7-x64

3

TCCTL32.dll

windows10-2004-x64

3

client32.exe

windows7-x64

10

client32.exe

windows10-2004-x64

10

msvcr100.dll

windows7-x64

3

msvcr100.dll

windows10-2004-x64

3

pcicapi.dll

windows7-x64

3

pcicapi.dll

windows10-2004-x64

3

remcmdstub.exe

windows7-x64

3

remcmdstub.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d43244539e6f2d18177bd4aefa92d75f4dca197b82d01e9d5b6065d501611ae6.zip

  • Size

    2.2MB

  • Sample

    241102-kjn5xazjhy

  • MD5

    c56a7dcc8c1658fa154501ac0819ba7e

  • SHA1

    df1910ff30aa8b64808b7bd7a6558fbfcf731a9a

  • SHA256

    d43244539e6f2d18177bd4aefa92d75f4dca197b82d01e9d5b6065d501611ae6

  • SHA512

    aa06d0b61b163b35b99dc7edb61655bcb4d9b4c909e3eebd0d4f587a9cee8de8ffd2a0e9fca44e382d076af2502ee962d73cd572be39e8a35abcfedb0b386a96

  • SSDEEP

    49152:StY8YsXuUchyrrP04n5YQIQNtV8CyU7XBffG4ABLOdPY:v8Ysa8PDcQNtVzyc2JlOVY

Score
10/10
netsupportdiscoveryrat

Malware Config

Targets

    • Target

      AudioCapture.dll

    • Size

      91KB

    • MD5

      4182f37b9ba1fa315268c669b5335dde

    • SHA1

      2c13da0c10638a5200fed99dcdcf0dc77a599073

    • SHA256

      a74612ae5234d1a8f1263545400668097f9eb6a01dfb8037bc61ca9cae82c5b8

    • SHA512

      4f22ad5679a844f6ed248bf2594af94cf2ed1e5c6c5441f0fb4de766648c17d1641a6ce7c816751f0520a3ae336479c15f3f8b6ebe64a76c38bc28a02ff0f5dc

    • SSDEEP

      1536:wrOxDJs/Ksdl0R1dBmhFXxRpP9JNvbnPUGI:3yXlQmhhHp9J9bnPTI

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      HTCTL32.DLL

    • Size

      320KB

    • MD5

      2d3b207c8a48148296156e5725426c7f

    • SHA1

      ad464eb7cf5c19c8a443ab5b590440b32dbc618f

    • SHA256

      edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

    • SHA512

      55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

    • SSDEEP

      6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      PCICHEK.DLL

    • Size

      18KB

    • MD5

      a0b9388c5f18e27266a31f8c5765b263

    • SHA1

      906f7e94f841d464d4da144f7c858fa2160e36db

    • SHA256

      313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

    • SHA512

      6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

    • SSDEEP

      192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      PCICL32.DLL

    • Size

      3.5MB

    • MD5

      214a714ef11c2c91162a9344bf8f2e50

    • SHA1

      b87886b6b1e48e5e54e3033be9a73b67b5a5c282

    • SHA256

      74dfcd891813058b29b0a70ec0a95f31cd5356f175ad3a492daecbc52542e76f

    • SHA512

      a785d390c7e066628c9894302ca10ac21ba79d9988523d5abcb960870a39112d01984a86cde0bcd3862d46d82696e35ba760d96a389c96553ecb1db9c3a0d97d

    • SSDEEP

      49152:5fgiLcxYMP9Y7fPUVBS7jNOXhmSTwpa1ycVSENqb:5fhLcxYMePUCjzGS7

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      TCCTL32.DLL

    • Size

      448KB

    • MD5

      69f72ad2dad99ff0fbc7f2c671523014

    • SHA1

      8aaab0955014b89ca794a51dd527d3afe6f38a94

    • SHA256

      23f17cc168cc82b8ae16f3fc041d4465e1b12e66dcac1713f582f99303a740dd

    • SHA512

      ea18d92790f52405027666b7501cf908426b9b57fec4157a45d86387d50324e414644245269dc1a0567b27c6c4b7c4b323d692bf449add4797dfcd7101531349

    • SSDEEP

      12288:suqhtvbez3wj9AP8Ah0DAmlse99fow3/qkxf5iJg0nTUtnTvm:s3htk/eHoJktEKITUFTvm

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      client32.exe

    • Size

      118KB

    • MD5

      4f2d0f4a5ba798fa9e85379c7c4bd36e

    • SHA1

      e533f2318d232ef3e1b22bdd1d6b61c081c6d6eb

    • SHA256

      aaa12a1ad8c748fbfd4c8f2e5023ec3481b18cb088b28737fc7e665163cff41d

    • SHA512

      4c338e4f87f5ac9e9339e663739b021f06d8ee48f7a5981ccdf85029888964e3c416331c7ec791933a6b3d56ec44bb3719a38039f625a25b86ba0264e3d2d609

    • SSDEEP

      768:Wm8j0+RvW6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDJg:WbpvWiLniepfxP91/bQxEj

    Score
    10/10
    netsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport
    behavioral11behavioral12

    • Target

      msvcr100.dll

    • Size

      755KB

    • MD5

      0e37fbfa79d349d672456923ec5fbbe3

    • SHA1

      4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    • SHA256

      8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    • SHA512

      2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

    • SSDEEP

      12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      pcicapi.dll

    • Size

      32KB

    • MD5

      dcde2248d19c778a41aa165866dd52d0

    • SHA1

      7ec84be84fe23f0b0093b647538737e1f19ebb03

    • SHA256

      9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

    • SHA512

      c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

    • SSDEEP

      768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      remcmdstub.exe

    • Size

      70KB

    • MD5

      2a2fc166269efe48d61cb1ab92215dc2

    • SHA1

      a5679174d941919baf764f94640994c01d695625

    • SHA256

      73a522d9ffa9235fe2b6fd1059c551f8022437ec0eef62ebc07240158f84a2a6

    • SHA512

      13f76217664056d1fbb106820a3a7e3f44e81cd373c812e89bd6d315ac2a188a8140e0ec0a7bda02be62afab86f8962340e5889c6bbe36305c96d700871f9e1e

    • SSDEEP

      1536:0fanvXuNOwphKuyUHTqYXHhrXH4xLIyqxoiuwbioQ+Dwajduw9tQ+8iAAe:+anPSpAFUzt0xLIyqVD9njdFyDAe

    Score
    3/10
    discovery
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks