Overview

overview

10

Static

static

1

das.php.zip

windows7-x64

10

das.php.zip

windows10-2004-x64

1

HTCTL32.dll

windows7-x64

3

HTCTL32.dll

windows10-2004-x64

3

Insta/deutsch.lng

windows7-x64

3

Insta/deutsch.lng

windows10-2004-x64

3

LogoDev.png

windows7-x64

3

LogoDev.png

windows10-2004-x64

3

NSM.lic

windows7-x64

3

NSM.lic

windows10-2004-x64

3

NSM.ini

windows7-x64

1

NSM.ini

windows10-2004-x64

1

PCICHEK.dll

windows7-x64

3

PCICHEK.dll

windows10-2004-x64

3

PCICL32.dll

windows7-x64

3

PCICL32.dll

windows10-2004-x64

3

TCCTL32.dll

windows7-x64

3

TCCTL32.dll

windows10-2004-x64

3

client32.exe

windows7-x64

10

client32.exe

windows10-2004-x64

10

client32.ini

windows7-x64

1

client32.ini

windows10-2004-x64

1

delegatedW...es.xml

windows7-x64

3

delegatedW...es.xml

windows10-2004-x64

1

install_state.json

windows7-x64

3

install_state.json

windows10-2004-x64

3

msvcr100.dll

windows7-x64

3

msvcr100.dll

windows10-2004-x64

3

nskbfltr.inf

windows7-x64

1

nskbfltr.inf

windows10-2004-x64

1

nsm_vpro.ini

windows7-x64

1

nsm_vpro.ini

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    das.php.decoded

  • Size

    2.2MB

  • Sample

    241115-t4zxks1nal

  • MD5

    0cc4ae68865ad3c85c1373f28ef04f81

  • SHA1

    3572e86c09e8142ada3779d2aaaa46268c992273

  • SHA256

    c2ba0018de8dcf0abfb2669cce95ed09377e9a9da7ff8e74e95688c99a025634

  • SHA512

    d110b21e5981165bd497d6d174233b4a517a16afe185c14e90064af2f6e0baf4c117626cb067b7ec4c57600dbf770bc68f942e936c26ab6402c125a1ead29003

  • SSDEEP

    49152:a51ZlklEDThXBJOhHvh6J6h2SFFGf0RBNTQfYc9jh23eWeB3/YSBm7WIqRRakTSR:E1tFXa/hRFY89YYc9jh23redpmQRY

Score
10/10
netsupportdiscoveryrat

Malware Config

Targets

    • Target

      das.php.decoded

    • Size

      2.2MB

    • MD5

      0cc4ae68865ad3c85c1373f28ef04f81

    • SHA1

      3572e86c09e8142ada3779d2aaaa46268c992273

    • SHA256

      c2ba0018de8dcf0abfb2669cce95ed09377e9a9da7ff8e74e95688c99a025634

    • SHA512

      d110b21e5981165bd497d6d174233b4a517a16afe185c14e90064af2f6e0baf4c117626cb067b7ec4c57600dbf770bc68f942e936c26ab6402c125a1ead29003

    • SSDEEP

      49152:a51ZlklEDThXBJOhHvh6J6h2SFFGf0RBNTQfYc9jh23eWeB3/YSBm7WIqRRakTSR:E1tFXa/hRFY89YYc9jh23redpmQRY

    Score
    10/10
    netsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      HTCTL32.DLL

    • Size

      320KB

    • MD5

      c94005d2dcd2a54e40510344e0bb9435

    • SHA1

      55b4a1620c5d0113811242c20bd9870a1e31d542

    • SHA256

      3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

    • SHA512

      2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

    • SSDEEP

      6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Insta/deutsch.lng

    • Size

      37KB

    • MD5

      6d0f7f40ffb4b086dbb005dd1cefa74c

    • SHA1

      a3a58c95190fa925b2fd8e8331fea274f4a4424b

    • SHA256

      dcf32f5ce7d24e71d0da282b42512da62b6e820ca9d785d44532fa1c58e8e896

    • SHA512

      1d69412199d23ee47cbb08d8522bb6a3915fff4b639321401ef87f8c34c57378e500f97efbc2e0a2f324f6ff164cbd99753ffe65e2930b677ef0865d0080b9a3

    • SSDEEP

      768:mUhaIVUG4H248PFTGfstfGpDtImrVb0Z5oAReHGpUGMTw/MD8TQDjmulOgU2RWxC:mUhaIVUG4248PFTGfstfGpDtImrVb0IJ

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      LogoDev.png

    • Size

      23KB

    • MD5

      b8f553fbd3dc34b58bc77a705711023d

    • SHA1

      4ab1052f906fda96f877e398426da5646574c878

    • SHA256

      2761c60263a2919b856915bdd2a0604b7f0e56e59d893ab13cccef2b7c967229

    • SHA512

      15a1df0dbb06b4bb64a2b8cd7ad22578292d5ecdec64303350e027f9f87fa8a825cb1cc97f94862d8c235c85b0c79a4feabfb89d9e0b77be62aab25785122a60

    • SSDEEP

      384:qSVmAf6Ft8Itb+e2b9tdTwEy9kXs6vWZZCbiXSeEO/12Hb40yrWSbN8qtA:qImAfe7gx3y6MZC2CeV2747zbN8

    Score
    3/10
    behavioral7behavioral8

    • Target

      NSM.LIC

    • Size

      195B

    • MD5

      e9609072de9c29dc1963be208948ba44

    • SHA1

      03bbe27d0d1ba651ff43363587d3d6d2e170060f

    • SHA256

      dc6a52ad6d637eb407cc060e98dfeedcca1167e7f62688fb1c18580dd1d05747

    • SHA512

      f0e26aa63b0c7f1b31074b9d6eef88d0cfbc467f86b12205cb539a45b0352e77ce2f99f29baeab58960a197714e72289744143ba17975699d058fe75d978dfd0

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      NSM.ini

    • Size

      6KB

    • MD5

      88b1dab8f4fd1ae879685995c90bd902

    • SHA1

      3d23fb4036dc17fa4bee27e3e2a56ff49beed59d

    • SHA256

      60fe386112ad51f40a1ee9e1b15eca802ced174d7055341c491dee06780b3f92

    • SHA512

      4ea2c20991189fe1d6d5c700603c038406303cca594577ddcbc16ab9a7915cb4d4aa9e53093747db164f068a7ba0f568424bc8cb7682f1a3fb17e4c9ec01f047

    • SSDEEP

      96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS

    Score
    1/10
    behavioral11behavioral12

    • Target

      PCICHEK.DLL

    • Size

      18KB

    • MD5

      104b30fef04433a2d2fd1d5f99f179fe

    • SHA1

      ecb08e224a2f2772d1e53675bedc4b2c50485a41

    • SHA256

      956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd

    • SHA512

      5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

    • SSDEEP

      192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      PCICL32.DLL

    • Size

      3.6MB

    • MD5

      d3d39180e85700f72aaae25e40c125ff

    • SHA1

      f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15

    • SHA256

      38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5

    • SHA512

      471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

    • SSDEEP

      49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      TCCTL32.DLL

    • Size

      387KB

    • MD5

      2c88d947a5794cf995d2f465f1cb9d10

    • SHA1

      c0ff9ea43771d712fe1878dbb6b9d7a201759389

    • SHA256

      2b92ea2a7d2be8d64c84ea71614d0007c12d6075756313d61ddc40e4c4dd910e

    • SHA512

      e55679ff66ded375a422a35d0f92b3ac825674894ae210dbef3642e4fc232c73114077e84eae45c6e99a60ef4811f4a900b680c3bf69214959fa152a3dfbe542

    • SSDEEP

      12288:HqArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/n6:ekuK2XOjksobom/n6

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      client32.exe

    • Size

      101KB

    • MD5

      c4f1b50e3111d29774f7525039ff7086

    • SHA1

      57539c95cba0986ec8df0fcdea433e7c71b724c6

    • SHA256

      18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d

    • SHA512

      005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5

    • SSDEEP

      768:q78j0+RH6e6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDU:qwpHLiLniepfxP91/bQxnu

    Score
    10/10
    netsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport
    behavioral19behavioral20

    • Target

      client32.ini

    • Size

      669B

    • MD5

      f734588a7620c48021688d3c2940353a

    • SHA1

      c9b9aece48b4c134b838217426145fdd542f60e6

    • SHA256

      97a2ce9683de5c9e03331d22309b5348f45cf65e77b1f011ba3505e2deafafc6

    • SHA512

      0549dcc50347802c774078f6f9ecfec2b21b0c489aa8e96168ea12a2cec55169d4172baac13819a07686755697794f05ac5b75d554229faf268f9e64f54e2033

    Score
    1/10
    behavioral21behavioral22

    • Target

      delegatedWebFeatures.sccd

    • Size

      17KB

    • MD5

      7fd9cd05f23d42fb6deda65bd1977ac9

    • SHA1

      df25a2c9e1e9fa05805da69ff41337b9f59755fb

    • SHA256

      ca6c469655d4d0d7ce5beb447dab43048a377a6042c4800b322257567ac135d9

    • SHA512

      6ae8addf0c55058803305f937593ba02202c99639a572be0cacbfde598019cf8db7067e0392bd66c43cf7d8780e454ec5e08d68bcfd491b60a450ffc280c81b8

    • SSDEEP

      384:nPzOC+5CNMCUDCGxkKp2Z+TgNKvoUwyBDZS/1pMimimp5F9aQBb+ZIo1PCCZAhy1:niZtnLkKp2Z+TgNKvoUwqVS/L3mimp5i

    Score
    3/10
    discovery
    behavioral23behavioral24

    • Target

      install_state.json

    • Size

      1KB

    • MD5

      3f78a0569c858ad26452633157103095

    • SHA1

      8119bcc1d66b17ccd286fef396fa48594188c4d0

    • SHA256

      d53fc339533d39f413ddd29a69ade19f2972383db8fb8938d77d2e79c8573f36

    • SHA512

      89842e39703970108135d71ce4c039df19c18f04c280cb2516409758f9d22e0205567b08dbe527a6fb7c295bda2ea8ee6a368d6fcaf6fb59645d31ef2243ad3d

    Score
    3/10
    discovery
    behavioral25behavioral26

    • Target

      msvcr100.dll

    • Size

      755KB

    • MD5

      0e37fbfa79d349d672456923ec5fbbe3

    • SHA1

      4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    • SHA256

      8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    • SHA512

      2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

    • SSDEEP

      12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z

    Score
    3/10
    discovery
    behavioral27behavioral28

    • Target

      nskbfltr.inf

    • Size

      328B

    • MD5

      26e28c01461f7e65c402bdf09923d435

    • SHA1

      1d9b5cfcc30436112a7e31d5e4624f52e845c573

    • SHA256

      d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368

    • SHA512

      c30ec66fecb0a41e91a31804be3a8b6047fc3789306adc106c723b3e5b166127766670c7da38d77d3694d99a8cddb26bc266ee21dba60a148cdf4d6ee10d27d7

    Score
    1/10
    behavioral29behavioral30

    • Target

      nsm_vpro.ini

    • Size

      46B

    • MD5

      3be27483fdcdbf9ebae93234785235e3

    • SHA1

      360b61fe19cdc1afb2b34d8c25d8b88a4c843a82

    • SHA256

      4bfa4c00414660ba44bddde5216a7f28aeccaa9e2d42df4bbff66db57c60522b

    • SHA512

      edbe8cf1cbc5fed80fedf963ade44e08052b19c064e8bca66fa0fe1b332141fbe175b8b727f8f56978d1584baaf27d331947c0b3593aaff5632756199dc470e5

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
1/10

behavioral1

netsupportdiscoveryrat
Score
10/10

behavioral2

Score
1/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

Score
3/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

Score
3/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

netsupportdiscoveryrat
Score
10/10

behavioral20

netsupportdiscoveryrat
Score
10/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

discovery
Score
3/10

behavioral24

Score
1/10

behavioral25

discovery
Score
3/10

behavioral26

Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10