Overview

overview

10

Static

static

10

o.ps1

windows7-x64

6

o.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    o.png

  • Size

    1KB

  • Sample

    241219-xtz2daxnf1

  • MD5

    a9053a6606748a87a135b942eb47a8c0

  • SHA1

    6062cea39903e0bdfa10c45e54c335d88be71962

  • SHA256

    a6f4b90b39688c9920b9f8198e559e3ace42e46d5a31811dffbfb4c2532faf93

  • SHA512

    39bdd26201c1bee319447dde6c132a159403d6a1bf2b44be8ab0d2730aad45b7ba800f55d5a45c6bb9376a8d297cacfe10ab659234fa4846fd08fb7f2e328be5

Score
10/10
netsupportdefense_evasiondiscoveryexecutionpersistencerat

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://goaccredited.biz/o/1.png
exe.dropper

http://goaccredited.biz/o/2.png
exe.dropper

http://goaccredited.biz/o/3.png
exe.dropper

http://goaccredited.biz/o/4.png
exe.dropper

http://goaccredited.biz/o/5.png
exe.dropper

http://goaccredited.biz/o/6.png
exe.dropper

http://goaccredited.biz/o/7.png
exe.dropper

http://goaccredited.biz/o/8.png
exe.dropper

http://goaccredited.biz/o/9.png
exe.dropper

http://goaccredited.biz/o/10.png
exe.dropper

http://goaccredited.biz/o/11.png
exe.dropper

http://goaccredited.biz/o/12.png

Targets

    • Target

      o.png

    • Size

      1KB

    • MD5

      a9053a6606748a87a135b942eb47a8c0

    • SHA1

      6062cea39903e0bdfa10c45e54c335d88be71962

    • SHA256

      a6f4b90b39688c9920b9f8198e559e3ace42e46d5a31811dffbfb4c2532faf93

    • SHA512

      39bdd26201c1bee319447dde6c132a159403d6a1bf2b44be8ab0d2730aad45b7ba800f55d5a45c6bb9376a8d297cacfe10ab659234fa4846fd08fb7f2e328be5

    Score
    10/10
    defense_evasionexecutionpersistencenetsupportdiscoveryrat

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Netsupport family

      netsupport

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks