Overview

overview

10

Static

static

3

fieldanaly...ro.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ced18d280101043439d4896d6f736e5a5e1626cafa8d4c3f65f8fc33734643a

  • Size

    1.6MB

  • Sample

    241206-sgesfsypfn

  • MD5

    b2508d2e6af698b7f306b632c41f7618

  • SHA1

    c7767ef48d009032a2b29b07eedd7d3fc32bda93

  • SHA256

    0ced18d280101043439d4896d6f736e5a5e1626cafa8d4c3f65f8fc33734643a

  • SHA512

    a6360c87d6cfb4677d49f9414493b95676c13ad3902ace3a80836e707bc6c8d696a7c16027d2dd78ce5fdc89e8fe2963062185523f9db4b625cca34b33b41a2c

  • SSDEEP

    49152:U8ONZqrAmJCEUgnAwvsMy729k8Xh7LSeFOb:U5NsrRlUR72a6pSB

Score
10/10
netsupportdiscoverypersistencerat

Malware Config

Targets

    • Target

      fieldanalystspro/fieldanalystspro.exe

    • Size

      1.7MB

    • MD5

      f411f07437db9f29222e19af93f72906

    • SHA1

      7ec2b1590b1f2670c1c04c1b9f2d1d021c589a84

    • SHA256

      5dd4a822034679a3827712848e2c674e01626de2fbacd569b20c634efb45f7be

    • SHA512

      4d63eb0f41c75f5cebbdededbd2a774499db5fe6de419b6b03be789fe8048beeb01bba753a519ecd50d9dcb13c95002b75898fbbf95a8b02e590eef14f1b4bab

    • SSDEEP

      49152:zj+INBqrisJUKUgfRaAyL4swER2EpFC5K:lNkr1fRM9R2+

    Score
    10/10
    netsupportdiscoverypersistencerat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks