Overview

overview

10

Static

static

1

Update.js

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Update.js

  • Size

    3.9MB

  • Sample

    241114-w588rasane

  • MD5

    63693e30eb835046a0db9785f689819c

  • SHA1

    288438abcddd04599e240330b6d84f3b174642b1

  • SHA256

    bb451151e52f0868f98e32d26ffa7c2be412b47cd470bf90d3cfe777b4a19f85

  • SHA512

    cc7d964df6f4df261022ad436b5e0d89418f4b19c8c3d43d39febff8d1ba20bbce6848137e0241d8ebadab66fae281bea604d6fff23c448a4fd725a85cc1da44

  • SSDEEP

    49152:OCz4F9dM2furCz4F9dM2fu1Cz4F9dM2furCz4F9dM2fuVCz4F9dM2furCz4F9dME:OkGgkGwkGgkGMkGgkG9

Score
10/10
netsupportdiscoveryexecutionpersistencerat

Malware Config

Targets

    • Target

      Update.js

    • Size

      3.9MB

    • MD5

      63693e30eb835046a0db9785f689819c

    • SHA1

      288438abcddd04599e240330b6d84f3b174642b1

    • SHA256

      bb451151e52f0868f98e32d26ffa7c2be412b47cd470bf90d3cfe777b4a19f85

    • SHA512

      cc7d964df6f4df261022ad436b5e0d89418f4b19c8c3d43d39febff8d1ba20bbce6848137e0241d8ebadab66fae281bea604d6fff23c448a4fd725a85cc1da44

    • SSDEEP

      49152:OCz4F9dM2furCz4F9dM2fu1Cz4F9dM2furCz4F9dM2fuVCz4F9dM2furCz4F9dME:OkGgkGwkGgkGMkGgkG9

    Score
    10/10
    netsupportdiscoveryexecutionpersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Blocklisted process makes network request

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks