netsupport | e0ff12dd4dbad622cf4596ef3c00296e99d47aa8e038d32209323887fba730da | Triage

Sharing

General

Target

yyy.zip
Size

2.6MB
Sample

241229-3g7tcazqds
MD5

2c83c4570b4773898a574e4143d11241
SHA1

cd8632e7edace07cddab7d0b2babecf12e58a102
SHA256

e0ff12dd4dbad622cf4596ef3c00296e99d47aa8e038d32209323887fba730da
SHA512

75ddf226a14515d61a66e9c6c5e5535b0ea6f5c7510d5f8140b7df7dab5befa2ce2aab240bc6e3663189df8d22d860590950a4e39c1d2069294c0b15ea695bf7
SSDEEP

49152:ZZQdM9sL3HYZucbQlRsXwlKsaFnTT7Ejujwk/wGZ1f0ZjkJGwuPVuJREAED4T42u:TQdMeoocbQQXwlSTQju0k/wGvYk8wrRW

Score

10^/10

netsupport discovery rat

Malware Config

Targets

- Target
  
  yyy.zip
- Size
  
  2.6MB
- MD5
  
  2c83c4570b4773898a574e4143d11241
- SHA1
  
  cd8632e7edace07cddab7d0b2babecf12e58a102
- SHA256
  
  e0ff12dd4dbad622cf4596ef3c00296e99d47aa8e038d32209323887fba730da
- SHA512
  
  75ddf226a14515d61a66e9c6c5e5535b0ea6f5c7510d5f8140b7df7dab5befa2ce2aab240bc6e3663189df8d22d860590950a4e39c1d2069294c0b15ea695bf7
- SSDEEP
  
  49152:ZZQdM9sL3HYZucbQlRsXwlKsaFnTT7Ejujwk/wGZ1f0ZjkJGwuPVuJREAED4T42u:TQdMeoocbQQXwlSTQju0k/wGvYk8wrRW
Score

1^/10
behavioral1 behavioral2
- Target
  
  HTCTL32.DLL
- Size
  
  320KB
- MD5
  
  c94005d2dcd2a54e40510344e0bb9435
- SHA1
  
  55b4a1620c5d0113811242c20bd9870a1e31d542
- SHA256
  
  3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
- SHA512
  
  2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
- SSDEEP
  
  6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  NSM.LIC
- Size
  
  195B
- MD5
  
  e9609072de9c29dc1963be208948ba44
- SHA1
  
  03bbe27d0d1ba651ff43363587d3d6d2e170060f
- SHA256
  
  dc6a52ad6d637eb407cc060e98dfeedcca1167e7f62688fb1c18580dd1d05747
- SHA512
  
  f0e26aa63b0c7f1b31074b9d6eef88d0cfbc467f86b12205cb539a45b0352e77ce2f99f29baeab58960a197714e72289744143ba17975699d058fe75d978dfd0
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  NSM.ini
- Size
  
  6KB
- MD5
  
  88b1dab8f4fd1ae879685995c90bd902
- SHA1
  
  3d23fb4036dc17fa4bee27e3e2a56ff49beed59d
- SHA256
  
  60fe386112ad51f40a1ee9e1b15eca802ced174d7055341c491dee06780b3f92
- SHA512
  
  4ea2c20991189fe1d6d5c700603c038406303cca594577ddcbc16ab9a7915cb4d4aa9e53093747db164f068a7ba0f568424bc8cb7682f1a3fb17e4c9ec01f047
- SSDEEP
  
  96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
Score

1^/10
behavioral7 behavioral8
- Target
  
  PCICHEK.DLL
- Size
  
  18KB
- MD5
  
  104b30fef04433a2d2fd1d5f99f179fe
- SHA1
  
  ecb08e224a2f2772d1e53675bedc4b2c50485a41
- SHA256
  
  956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
- SHA512
  
  5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
- SSDEEP
  
  192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  PCICL32.DLL
- Size
  
  3.6MB
- MD5
  
  d3d39180e85700f72aaae25e40c125ff
- SHA1
  
  f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
- SHA256
  
  38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
- SHA512
  
  471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
- SSDEEP
  
  49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  TCCTL32.DLL
- Size
  
  387KB
- MD5
  
  2c88d947a5794cf995d2f465f1cb9d10
- SHA1
  
  c0ff9ea43771d712fe1878dbb6b9d7a201759389
- SHA256
  
  2b92ea2a7d2be8d64c84ea71614d0007c12d6075756313d61ddc40e4c4dd910e
- SHA512
  
  e55679ff66ded375a422a35d0f92b3ac825674894ae210dbef3642e4fc232c73114077e84eae45c6e99a60ef4811f4a900b680c3bf69214959fa152a3dfbe542
- SSDEEP
  
  12288:HqArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/n6:ekuK2XOjksobom/n6
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  client32.exe
- Size
  
  101KB
- MD5
  
  c4f1b50e3111d29774f7525039ff7086
- SHA1
  
  57539c95cba0986ec8df0fcdea433e7c71b724c6
- SHA256
  
  18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d
- SHA512
  
  005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5
- SSDEEP
  
  768:q78j0+RH6e6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDU:qwpHLiLniepfxP91/bQxnu
Score

10^/10

netsupport discovery rat
- NetSupport
  NetSupport is a remote access tool sold as a legitimate system administration software.
  rat netsupport
- Netsupport family
  netsupport
behavioral15 behavioral16
- Target
  
  client32.ini
- Size
  
  671B
- MD5
  
  1f3911aa581f74218174a75d1d44aebe
- SHA1
  
  67cac52f8457c77a93338109d6615145d1148e17
- SHA256
  
  010dc2cdbdbca9199aca04a93165259b48bbacaafd142d0597e2b168b0c7809e
- SHA512
  
  c5d825bcd2c44f8e83ef1b3a0f185f93c23e365cff55051231c676fc5b68dbf50ef7a6a466e1b2fd3b3c942b68270207e08eb18aba04e768226419c8054ad30f
Score

1^/10
behavioral17 behavioral18
- Target
  
  install_state.json
- Size
  
  1KB
- MD5
  
  3f78a0569c858ad26452633157103095
- SHA1
  
  8119bcc1d66b17ccd286fef396fa48594188c4d0
- SHA256
  
  d53fc339533d39f413ddd29a69ade19f2972383db8fb8938d77d2e79c8573f36
- SHA512
  
  89842e39703970108135d71ce4c039df19c18f04c280cb2516409758f9d22e0205567b08dbe527a6fb7c295bda2ea8ee6a368d6fcaf6fb59645d31ef2243ad3d
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  msvcr100.dll
- Size
  
  755KB
- MD5
  
  0e37fbfa79d349d672456923ec5fbbe3
- SHA1
  
  4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA256
  
  8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- SHA512
  
  2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP
  
  12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  nskbfltr.inf
- Size
  
  328B
- MD5
  
  26e28c01461f7e65c402bdf09923d435
- SHA1
  
  1d9b5cfcc30436112a7e31d5e4624f52e845c573
- SHA256
  
  d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368
- SHA512
  
  c30ec66fecb0a41e91a31804be3a8b6047fc3789306adc106c723b3e5b166127766670c7da38d77d3694d99a8cddb26bc266ee21dba60a148cdf4d6ee10d27d7
Score

1^/10
behavioral23 behavioral24
- Target
  
  nsm_vpro.ini
- Size
  
  46B
- MD5
  
  3be27483fdcdbf9ebae93234785235e3
- SHA1
  
  360b61fe19cdc1afb2b34d8c25d8b88a4c843a82
- SHA256
  
  4bfa4c00414660ba44bddde5216a7f28aeccaa9e2d42df4bbff66db57c60522b
- SHA512
  
  edbe8cf1cbc5fed80fedf963ade44e08052b19c064e8bca66fa0fe1b332141fbe175b8b727f8f56978d1584baaf27d331947c0b3593aaff5632756199dc470e5
Score

1^/10
behavioral25 behavioral26
- Target
  
  pcicapi.dll
- Size
  
  32KB
- MD5
  
  34dfb87e4200d852d1fb45dc48f93cfc
- SHA1
  
  35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
- SHA256
  
  2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
- SHA512
  
  f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
- SSDEEP
  
  768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  remcmdstub.exe
- Size
  
  62KB
- MD5
  
  6fca49b85aa38ee016e39e14b9f9d6d9
- SHA1
  
  b0d689c70e91d5600ccc2a4e533ff89bf4ca388b
- SHA256
  
  fedd609a16c717db9bea3072bed41e79b564c4bc97f959208bfa52fb3c9fa814
- SHA512
  
  f9c90029ff3dea84df853db63dace97d1c835a8cf7b6a6227a5b6db4abe25e9912dfed6967a88a128d11ab584663e099bf80c50dd879242432312961c0cfe622
- SSDEEP
  
  1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  
  temp/ie_to_edge_bho.dll
- Size
  
  438KB
- MD5
  
  85ea4587843113f286c07f68e1f52cdf
- SHA1
  
  c0b0dcafb5bc2bc0654c8d0a681d06e2594f385f
- SHA256
  
  f473b764ab15dfcd0c7009e9e48f9142fd8f9f2a16d183e700c6dfd428ab8daa
- SHA512
  
  a2b4907a63273a75ea20052e4e83153dcfa246d5fc9c50bfd1b91cc25bf2f890d87ae47a30f0e362981455c89cf7f81026bf9f9d5dc5216143ced740484ae5cb
- SSDEEP
  
  6144:FB5DwLKugywR+FnkGMIj4fr2YOy+FI6TXezQhE41OqBPvOk7rYi:FBZwLGQ5yOy+FI6TzBPb
Score

3^/10

discovery
behavioral31
- Target
  
  temp/ie_to_edge_bho_64.dll
- Size
  
  561KB
- MD5
  
  abae72bacd4b539cd62aa59626a90929
- SHA1
  
  2477b6f5a3243f373188ecea06ca16d16793f915
- SHA256
  
  735bc62002b2841c5d1b156006b6a0ab94bcd475cc760c5161162429e1073883
- SHA512
  
  9afe68b6c98d111a8579cddc99e1293b2f5a032211e9dbdf44cc0774c867a7424253aec8c42e3e73f1f6a45f7a9d8512b131609c5226be0270c6593f6eed1dcf
- SSDEEP
  
  6144:Bak4zUeoZs4TB8D3qQAtoOk9SkxDgo5B8+ivLOLwR8Ph4ofUmJO6XvvLgAs:Bj44o4t8DaH/+SkbQv6LwR8PhAmJO6E
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

netsupportdiscoveryrat

behavioral16

netsupportdiscoveryrat

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32