Overview

overview

10

Static

static

1

990.ps1

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    990.ps1

  • Size

    2KB

  • Sample

    241107-skhnhsvbrf

  • MD5

    6025de95cdf08c8f7574c7657922a38f

  • SHA1

    7c178482ab786d0c8feb909255f656b172037f46

  • SHA256

    b2daa2b5afb389828e088ec8b27c0636bdad94b2ef71dcf8034ee601cb60d8d6

  • SHA512

    0494771a03bb1a7d0ca29cc9807384ccd3571e5f5a4396dfbea6623eff92553f50c4d74e063b021beb23b726718556ac3e7a6eb62e69aab88310ab5644917c32

Score
10/10
netsupportdiscoveryexecutionpersistencerat

Malware Config

Targets

    • Target

      990.ps1

    • Size

      2KB

    • MD5

      6025de95cdf08c8f7574c7657922a38f

    • SHA1

      7c178482ab786d0c8feb909255f656b172037f46

    • SHA256

      b2daa2b5afb389828e088ec8b27c0636bdad94b2ef71dcf8034ee601cb60d8d6

    • SHA512

      0494771a03bb1a7d0ca29cc9807384ccd3571e5f5a4396dfbea6623eff92553f50c4d74e063b021beb23b726718556ac3e7a6eb62e69aab88310ab5644917c32

    Score
    10/10
    netsupportdiscoveryexecutionpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks